3 ms·

> Persona does everything right Except one thing: it requires cash (SSL cert[1]) you're stuck with the google/facebook/etc-style situation of having to rely on

by pdkl95 13y ago

> Persona does everything right Except one thing: it requires cash (SSL cert[1]) you're stuck with the google/facebook/etc-style situation of having to rely on a 3rd party to maintain your identity. It's not a popular opinion here where most people have well-paying tech jobs, but real identity and privacy on the net is something the retired, disabled, unemployed, single-parent, and other poor people need as well. Without solving this problem fist, you are simply incentivizing the current status quo and dooming any new scheme to fail. [1] No, that SSL cert is not "cheap" when you have to live on SSDI that doesn't even cover rent/food/etc fully. The domain itself is less expensive, and can be sub-delegated between a few people.

chc 13y ago
A domain costs about $10 a year. A RapidSSL cert costs about $10 a year. A StartSSL cert can be as cheap as $0 a year. I wouldn't say SSL certs are that expensive. And if you can't use HTTPS, nothing on your site is secure, so fussing over which authentication system you're going to critically compromise seems a bit academic.
- pdkl95 13y ago
  Spoken like someone who has never had to live in bay area on <$1500/month. SSDI (social security disability income) doesn't pay much, and rent for a tiny, crappy appartment in CA eats up a lot of that. $10-20 extra means not eating for a few days. A domain is free, if it's delegated. It's also something many people already have. StartSSL is not an option (had problems with them pre-openssl-mess; absolutely not an option now). This stuff misses the point, though: REAL privacy (not relying on a 3rd party like facebook) is a selling point that is becoming more popular "post-snowden". While I assume technical challenges can be made point-and-click easy over time, requiring cash is a hurdle that will shut out MANY people. Evidence: free email vs minor-fee/year email. Right now, any competing service is already up against the hurdle of trying to get people to switch from what they currently use (facebook, google). The idea of not being tide to a big company is enough to overcome that hurdle, for at least some people. Requiring cash scraps that window of opportunity, sometimes for actual cash-availability reasons, and others for perceived reasons.
  - chc 13y ago
    > StartSSL is not an option (had problems with them pre-openssl-mess; absolutely not an option now). I don't see how they're worse than no security at all, which is the alternative you appear to be proposing.
scrollaway 13y ago
Uhm... Persona certainly doesn't require its users to buy SSL certs. How many people are actually affected by your use case there? How many app developers are gonna go: "I'm working on my app and I want persona, but .. damn! 10 bucks a year! Can't afford that for my app that's going to be used by millions of users" I don't really get what you're getting at.
- pdkl95 13y ago
  https://developer.mozilla.org/en-US/Persona/Implementing_a_Persona_IdP https://developer.mozilla.org/en-US/Persona/Implementing_a_P... "The support document, provisioning page and authentication page must all be available over HTTPS, and the server's SSL certificate must be certified by a trusted CA whose certificate is in the standard Mozilla certificate bundle." I suspect you're still stuck in the "users will just use somebody else as their identify provider" trap. We've seen where that leads - it gave us Hotmail, GMail, Facebook, G+, "MS passport", and the like. Persona, on the other hand, correctly allows anybody to host their own identity - iff you can pay for it. "millions of users" Stop with the narrow thinking - that's not the only use-case for encryption, as the internet is not a many-to-one medium like TV. The personal website I put up for my friends should be encrypted, just like everything else we send over the net.

by pdkl95 13y ago

chc 13y ago

A domain costs about $10 a year. A RapidSSL cert costs about $10 a year. A StartSSL cert can be as cheap as $0 a year. I wouldn't say SSL certs are that expensive. And if you can't use HTTPS, nothing on your site is secure, so fussing over which authentication system you're going to critically compromise seems a bit academic.

pdkl95 13y ago
Spoken like someone who has never had to live in bay area on <$1500/month. SSDI (social security disability income) doesn't pay much, and rent for a tiny, crappy appartment in CA eats up a lot of that. $10-20 extra means not eating for a few days. A domain is free, if it's delegated. It's also something many people already have. StartSSL is not an option (had problems with them pre-openssl-mess; absolutely not an option now). This stuff misses the point, though: REAL privacy (not relying on a 3rd party like facebook) is a selling point that is becoming more popular "post-snowden". While I assume technical challenges can be made point-and-click easy over time, requiring cash is a hurdle that will shut out MANY people. Evidence: free email vs minor-fee/year email. Right now, any competing service is already up against the hurdle of trying to get people to switch from what they currently use (facebook, google). The idea of not being tide to a big company is enough to overcome that hurdle, for at least some people. Requiring cash scraps that window of opportunity, sometimes for actual cash-availability reasons, and others for perceived reasons.
- chc 13y ago
  > StartSSL is not an option (had problems with them pre-openssl-mess; absolutely not an option now). I don't see how they're worse than no security at all, which is the alternative you appear to be proposing.

scrollaway 13y ago

Uhm... Persona certainly doesn't require its users to buy SSL certs. How many people are actually affected by your use case there? How many app developers are gonna go: "I'm working on my app and I want persona, but .. damn! 10 bucks a year! Can't afford that for my app that's going to be used by millions of users" I don't really get what you're getting at.

pdkl95 13y ago
https://developer.mozilla.org/en-US/Persona/Implementing_a_Persona_IdP https://developer.mozilla.org/en-US/Persona/Implementing_a_P... "The support document, provisioning page and authentication page must all be available over HTTPS, and the server's SSL certificate must be certified by a trusted CA whose certificate is in the standard Mozilla certificate bundle." I suspect you're still stuck in the "users will just use somebody else as their identify provider" trap. We've seen where that leads - it gave us Hotmail, GMail, Facebook, G+, "MS passport", and the like. Persona, on the other hand, correctly allows anybody to host their own identity - iff you can pay for it. "millions of users" Stop with the narrow thinking - that's not the only use-case for encryption, as the internet is not a many-to-one medium like TV. The personal website I put up for my friends should be encrypted, just like everything else we send over the net.