Hacker News Reader

Comment by blueskin_ | Hacker News Reader

Yet another OpenID/OAuth/Whatever? Another SPOF.

Give me separate logins and KeePass any day.

The protocol itself doesn't come with an SPOF. Only the transitional current implementation, required for bootstrapping purposes, does require the JavaScript shim hosted by Mozilla. In the future, at least Firefox itself (on desktop, Android, and Firefox OS) will come with built-in support.

And, quite importantly, running your own identity provider (which is another SPOF in many systems) is pretty straightforward and well-defined in the Persona ecosystem.

If Identity Provider goes down, it is a SPOF for the account, but the same is with FB/Twitter login

In Persona, the Identity Provider is not involved in each login, it just signs a temporary certificate which can be re-used by the browser, so as long as the downtime is under a few hours, the user shouldn't have much of a problem.

And if the Identity Provider's gone for a prolonged period now you've lost your identity with (almost) no means of recovery. Mostly, because, while you might believed the contrary, you didn't ever own your "own" identity in this scheme.

That's exactly what SPOF is.

simply wrong. This is NOT another OpenID. Your judgment is an ignorant one. The long-term vision is even further from the current substantial departure from OpenID: to be verified by your browser instead via JS etc.

That sounds even less secure, if anything.

OpenID was far, far worse from a usability perspective.

Reply on news.ycombinator.com