4 ms·
For [11]: I think it makes sense to also highlight other approaches than OpenID such as https://passwordless.net https://passwordless.net which is a sort of way
by thesumofall 12y ago
For [11]: I think it makes sense to also highlight other approaches than OpenID such as https://passwordless.net https://passwordless.net which is a sort of way in the middle (disclaimer: I'm the author)
- scrollaway 12y agoAs a huge supporter of Persona, I am intrigued. Can you sell me on how this may be better?
- thesumofall 12y agoI think Persona is great and can be the right choice for many scenarios. Browser support, the JS requirement, and the reliance on email (whereas tokens can e.g. be distributed via text message) might however be points that convince developers to go with one-time passwords.
- scrollaway 12y ago> Browser support Persona is just a protocol though, it's implicitly supported by all browsers. Though in-browser auth (which is the ideal case) is only in Firefox so far... > JS requirement Granted. Though theoretically, you don't need javascript. > reliance on email Granted again, but this is a completely acceptable tradeoff for 99% of services which will require an email and usually even use it as the user's identification. Still not sold, but I'll keep your solution in mind. Thanks for alternatives! :)
- thesumofall 12y agoAlso, Persona still relies on passwords which are usually too weak and re-used across the web
- scrollaway 12y agoNo, Persona does not rely on passwords. Persona has authentication providers that rely on passwords.
- thesumofall 12y agoDepends on the email address you use :-) Gmail, etc. are directly supported - for any other email provider (or your self-hosted one) you'll need a password.
- omervk 12y agoAdded. Thanks :)