Comment by metafunctor | Hacker News Reader

Comment by metafunctor | Hacker News Reader

Seems like it was just a while ago I first heard of persona, and thought that it's a great idea.

Then, I did not hear of it again. Now, this. I have a couple of observations.

Branding this as "Mozilla Persona" makes it look like all the other corporate "one-time" login things out there. Apple ID, Microsoft Live, what have you. I don't need one more account controlled by a corporation. Mozilla looks like a corporation to me (maybe it is not, but it looks like one). I do not automatically trust everything with the Mozilla brand on it.

Adding Persona to a website is not that easy, from the developers' standpoint. I looked at it for a while, and couldn't be bothered. From the server side, it's just so simple to authenticate users with passwords (or access tokens derived thereof). It would be wonderful if the browser could just take care of everything, if all users really need is a way to securely authenticate. Currently, it seems to me like password managers are winning this game.

I'm hoping to see something where password managers are extended with protocols to allow more data and access to be shared to services I really use.

I was using it for years on our sites, IT IS very easy to implement for a developer, especially easier than dealing with oauth oddities from google,facebook,microsoft etc

Yes one can program own username/password etc login, but it is actually alot of work making a proper one with all the edge cases (, password strenght, email validation, verification, account recovery) and so on and so on. I know because I have done it dozens of time and each time the project has slightly different requirements

Mozilla Persona was dead easy to implement on the other hand! Also alot of people did not like and complained about having to login with Google, Facebook etc yet the same people had no issues trusting Mozilla due to the goodwill they built up with firefox and their fight for privacy

It really doesn't look all that easy. https://developer.mozilla.org/en-US/Persona/Quick_Setup

Especially compared with usernames and password, which is basically built in to anything already.

Compared to Oauth it's a cakewalk.

Even when using a framework that has username/password authentication already, you have to worry about whether your confirmation emails are getting sent properly and are not blocked. So, no, it's not simple.

Persona is the easiest one I've worked with, including usernames and passwords, because getting that correctly working with the best practices of 2015, even with built-in support in most frameworks, is and will always be a PITA, and heavily dependent on fragile DB schemas specific to a given framework's whims.

I think that usernames and passwords are "easy" is something of a sunk cost fallacy, both for developers and users, and we tend to forget how much time and effort we "waste" on this year over year. My password manager is up to hundreds of different passwords I use, and I know a lot of users these days whose "password" starts with the now ubiquitous "Forgot Password" button (which is its own headache to setup and get right), as they are okay relying on the relative security of their email address over the fragility of their own memory.

> Branding this as "Mozilla Persona" makes it look like all the other corporate "one-time" login things out there. Apple ID, Microsoft Live, what have you

I honestly thought that's what it was so had never considered it when looking at authentication. Whoops.

Reply on news.ycombinator.com