Beyond Passwords: Secure Authentication with Mozilla Persona

What people said

spellboots · 2013-12 · Strong recommendation

Please use Persona, it's this idea but much more thoroughly thought out and tested. Here is a great video about it: [VIDEO] If you have not heard of Persona, or have heard of it but don't see what the big deal is / why it's different to "Login with google", "Login with twitter" etc, then go watch this video. It is a very elegant, decentralised solution to the login problem.

Read the original HN comment ↗

callahad · 2016-10 · Reference

There's a little more discussion of that over on Lobsters: [LINK] . The TL;DR is that URIs just didn't work for the mass public. You had to supplement the login form with a NASCAR-esque wall of logos, which was awful for different reasons. Thus, Portier, and Persona before it, chose to identify users by email addresses. I talk a little bit about that at 9:05 in my PyCon 2013 talk on Persona: [VIDEO]

Read the original HN comment ↗

callahad · 2015-10 · Reference

Persona didn't have the notion of a global password -- the ideal flow had you authenticating with your email provider, on their domain, which was often completely transparent in cases where you were already signed in to that provider. Try logging into 123done.org with whatever you want @mockmyid.com to get a sense of what that would ideally look like. My talk from PyCon 2013 goes into a little detail about how the protocol works: [VIDEO]

Read the original HN comment ↗