Hacker News Reader

Comment by evolution | Hacker News Reader

I tried logging in -- persona sent me email of confirmation, when clicked it redirected to ebookglue which alerted 'login attempt failed'. you might want to look into that.

View on HN

I'm sorry about the trouble with Persona -- many people have been reporting issues, and it's unfortunately not been as stable as I would have wanted it to be. I'm looking into whether it's my own implementation (though I followed all the recommended best practices quite closely), or an issue with Persona itself.

EDIT: It's a known issue with Persona and third party cookies: https://github.com/mozilla/browserid/issues/1352

Unfortunately, this is a situation where a lot of people on HN probably disable third party cookies (though perhaps a larger percentage of HN readers already have Persona accounts?). Anyway, I'm looking into rolling out my own authentication with email/password soon.

I'd like to try it without logging in at all. The first question everyone will have is if it works on their own site or a site they are familiar with and to see the results. Having to create accounts/login just impedes that process.

I understand -- there's a bit of a problem when trying to prevent abuse, though, and relying on the Persona identity provider makes it easier to prevent abusive behavior upfront, especially since the conversions themselves consume a lot of resources.

I'm still working out the optimal solution, but thanks for the feedback!

In what way does Persona prevent abuse? All you validate is email receipt which can be trivially fudged using mailinator.

It is far better to deal with this sort of thing at the "transaction" level - eg use a captcha or similar for the second and subsequent conversions from a particular IP address.

It's just a rough barrier before I set up something a little better, though I already have logging at the transaction level set up. Even using Mailinator requires a little bit of work, so I figured Persona was a good starting point -- I'll look into adding a "try it out" area on the home page that doesn't require you to sign up though.

Reply on news.ycombinator.com