News for hackers. Stuff that matters.

A comment on Open Letter to Mozilla: Bring Back Persona. Parent comment

Re:Open Letter to Mozilla: Bring Back Persona by quadrangle on Thursday December 24, 2015 @01:24PM (#10789084)
The entire point of "Persona" is that it was actually something in the backend called "BrowserID" that was supposed to integrate with the browser instead of running some random JS widget in a page. Well, Mozilla never even finished implementing the first version of that before they declared "no traction"! What nonsense!
[ Parent | on HN ]
Re:Open Letter to Mozilla: Bring Back Persona by nickbauman on Thursday December 24, 2015 @04:51PM (#10789685)
Having native code handle something in the browser instead of a thin, easily verifiable javascript widget seems the opposite of a more secure solution.
[ Parent | on HN ]
Re:Open Letter to Mozilla: Bring Back Persona by deno on Thursday December 24, 2015 @06:05PM (#10789865)
You’re missing the point. Emphasis on “in the browser” not “native.”

http://www.extremetech.com/wp-content/uploads/2011/07/firefo...

[ Parent | on HN ]
Re:Open Letter to Mozilla: Bring Back Persona by nly on Thursday December 24, 2015 @06:02PM (#10789857)
No, because javascript puts the server in control of the code being run on the client. It renders the whole thing vulnerable to nasty attacks like spoofing and MITM.
[ Parent | on HN ]