News for hackers. Stuff that matters.
Re:Open Letter to Mozilla: Bring Back Persona by scrollaway on Thursday December 24, 2015 @10:41AM (#10788470)
Theoretically yes, but it's not as simple as that. Every identity can have more than one email associated with it, and emails can change over time. So "username == email" is fine as long as the concept of a username mutating is fine.
Re:Open Letter to Mozilla: Bring Back Persona by manigandham on Thursday December 24, 2015 @10:49AM (#10788489)
I don't see a problem, it just means you can login with multiple emails then. They're still unique to you. LinkedIn and Facebook and other services already do this.

A username/real name can still be used as the "name" if this is an online community or something similar.

Re:Open Letter to Mozilla: Bring Back Persona by kbenson on Thursday December 24, 2015 @12:18PM (#10788820)
LinkedIn and Facebook can do this because your email is not your username. There likely isn't really a username in those systems, just a user id. Almost all systems have a user id, but the distinction here is slightly different. Instead of a user record which has an id, username and possibly full name, Facebook likely has a user record with an id, a (display) username, and then there is a separate set of auth records with the multiple ways you can authenticate to the account, such as emails and passwords, API tokens, phone numbers, etc.

It may not sound like a big distinction, but there is a big distinction there. Instead of your username being your email address, they've abstracted the authentication from the core user record such that usernames are not used for authentication, so don't have to mutate if the authentication identifier (email address, phone number) changes, just some auth settings. This is obviously a much more extensible and robust way to deal with authentication over time, but it's also obvious it's much more complex than a simple username/password pair.

Re:Open Letter to Mozilla: Bring Back Persona by nileshtrivedi on Thursday December 24, 2015 @06:44PM (#10789940)
You are describing the tripartite identity pattern: http://habitatchronicles.com/2008/10/the-tripartite-identity...
Re:Open Letter to Mozilla: Bring Back Persona by kbenson on Thursday December 24, 2015 @07:22PM (#10789993)
For the most part. My example was more a bipartite pattern, because I was covering the authentication aspects, not the entire identity structure (which I believe Facebook and LinkedIn would implement as the article outlines). For a system where you don't need to track multiple social identities, and where you interact within that system through your identity on that system, that's probably enough.
Re:Open Letter to Mozilla: Bring Back Persona by manigandham on Thursday December 24, 2015 @09:29PM (#10790224)
Yea maybe I should've been more specific but I was just talking about the user's perspective: usernames aren't necessary for most sites and just means one more thing they have to create and remember.

Re: implementation - I don't see the big distinction. These are all just related properties of a master user id number. Those properties can be anything and any of them (in any combination) can be used to login.

Re:Open Letter to Mozilla: Bring Back Persona by stickfigure on Thursday December 24, 2015 @06:24PM (#10789907)
What you're describing is "use a synthetic primary key for your User", which is something even the most naive junior web developer does automatically these days. There's nothing special about LinkedIn and Facebook except that they went through the trouble of adding additional authentication mechanisms. You can too, no matter what you treat as a "username".
Re:Open Letter to Mozilla: Bring Back Persona by kbenson on Thursday December 24, 2015 @07:28PM (#10790006)
I'm not entirely sure where you got the impression I was implying it was hard and esoteric, and only Facebook and LinkedIn could do so. I was simply noting that there's a difference between email as a username and email as part of one or more authentication tokens, and the differences in design and how it affects the possible future need of users to change what are often usable as authentication (email addresses, phone numbers, etc).
Re:Open Letter to Mozilla: Bring Back Persona by toyg on Thursday December 24, 2015 @01:00PM (#10789001)
> They're still unique to you.

Nope. Most free email providers out there (including gmail) have policies for username expiration, some even quite aggressively (like one month without login). "Me" on one of these services might not be "me" in three months' time, but you-website won't know that and will happily send a password reset link to my old email.

Re:Open Letter to Mozilla: Bring Back Persona by maaku on Thursday December 24, 2015 @01:31PM (#10789123)
Also, people share email addresses.

Really, they do.

Re:Open Letter to Mozilla: Bring Back Persona by eximius on Friday December 25, 2015 @09:03AM (#10791248)
That thought makes me feel dirty.
Re:Open Letter to Mozilla: Bring Back Persona by usrusr on Friday December 25, 2015 @09:00AM (#10791245)
Many email addresses are dumb forwards without the eventual receiver (the "identified") even having an account directly related to the domain where the forwarding is done. Would those be usable for persona or only the "backend" address with an actual user login that collects forwarded emails and is ideally never given to a third party?
Re:Open Letter to Mozilla: Bring Back Persona by moron4hire on Friday December 25, 2015 @08:37AM (#10791187)
These are not unique to email addresses as identifiers, because people change over time. You can't even count on people's real names staying the same over time, as something as simple as marriage gives many an impetus to change it. Any database that assumes immutability of one's visible identity is broken by design.
Re:Open Letter to Mozilla: Bring Back Persona by k__ on Thursday December 24, 2015 @10:54AM (#10788516)
Wouldn't a new email be as unique as the old one? I mean mutating is only a problem if usernames collide.