badida

5 ms·

1.
by badida 13y ago
or until we give you a library you can audit and host yourself, which we're working on.
2.
by badida 13y ago
You should tell them you'd like them to :)
3.
by badida 13y ago
Choose your identity providers (and thus email addresses) wisely. They should be filtering spam for you / letting you control things. And they shouldn't be doing it by forcing you into their silo, the way "login with Twitter" buttons work.
4.
by badida 13y ago
Oh wait, I misread your point. Yes, the attacker can log into all Persona web sites if they know your Yahoo password. But that's the way the cookie crumbles with federated identity. It's the same thing if you pick a Yahoo email address as y
5.
by badida 13y ago
No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona. However, if you use the "login with Yahoo" button (or Google or Facebook), then y
6.
by badida 13y ago
Very good points, and we agree. We're going to bridge more Identity Providers. We're working on native implementations (though I suspect that those are less pressing than the other two angles.) As for big web sites... we've got some things
7.
by badida 13y ago
To be fair, if you want to understand why something is supposedly secure, you will have to spend some time :) Let's see if I can help. Your identity is tied to your ability to prove that you own an email address. You can do that by clicki
8.
by badida 13y ago
Let's see if I can help provide some answers here: a) certificates are stored in localStorage for https://login.persona.org . They are very short-lived (hours), so that we don't have to deal with revocation, since that would likely be impo
9.
Persona on Firefox OS phones(identity.mozilla.com)
4 points by badida 13y ago|1 comments
10.
by badida 13y ago
The are all good arguments, and again I want to point out that we are considering them. But there is a big security concern with DNS spoofing (and DNSSEC is not quite easy yet.) So it's not an obvious decision.
11.
by badida 13y ago
Every time you create an account at a new site, you're opening up a way to get hacked. Because, like most humans, you probably reuse passwords, or at least have password similarities. And many web sites tend not to have the resources to pro
12.
by badida 13y ago
Sorry, that's my bad. It's fixed now if you pull the latest eyedee.me.
13.
by badida 13y ago
I think the criticism that we haven't made a strong enough point of why this makes the Web more secure is legitimate. We haven't made this point as well as I'd like. I'll take that as inspiration for a future blog post. Thanks for pushing u
14.
by badida 13y ago
Thanks! Another good way to help Mozilla make the Web better for all is to implement Persona on web sites you build. It's easy and respects your users. Here's how you can do it in an hour or less: https://developer.mozilla.org/en-US/docs/p
15.
by badida 13y ago
It's worth pointing out that, a couple of years ago, we tried to make OpenID easier through Firefox integration. There was no good way to do it. The OpenID protocol doesn't lend itself to browser mediation. (In addition to the other usabili
16.
by badida 13y ago
Exactly right: we hate the NASCAR array of buttons that is publisher-centric, rather than user-centric. I wrote about this a few days ago on the Persona blog: http://identity.mozilla.com/post/45842909320/users-dont-like...
17.
by badida 13y ago
Yes, that is exactly right, and it's also why certs are short-lived (hours). When certs are renewed, the site the user plans on logging into is not revealed to the Identity Provider.
18.
by badida 13y ago
We're discussing the addition of a DNS discovery option. Not clear yet that this is something that can be secured as well as HTTPS discovery (which I don't consider abusive, given the number of systems that do it already.) But it's on our r
19.
by badida 14y ago
not yet, but we're working on it: https://github.com/mozilla/browserid/issues/3119
20.
by badida 14y ago
Check the Techcrunch article I cited: http://techcrunch.com/2012/11/30/email-social-signup-rockmel... - major social sites have seen data indicating that 50% of potential users don't sign up if it's social only. This is a real-people is
21.
by badida 15y ago
In earlier identity experiments at Mozilla, we tried. It never felt good as a user experience, in large part because OpenID was designed to not include the browser.