New Persona Beta: Millions of Users Ready to Log In using Any Browser

Re:New Persona Beta: Millions of Users Ready to Log In using... by shared4you on Tuesday April 09, 2013 @01:27PM (#5519613)

>> type in email, login to yahoo...

Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman?

Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

[ Parent | on HN ]

Re:New Persona Beta: Millions of Users Ready to Log In using... by ozten on Tuesday April 09, 2013 @02:01PM (#5519852)

> Wait. So, my email provider (Yahoo) can now keep track of every website I login to, if he wants? How can I stop Yahoo being the middleman?

Nope.

Architectures like OpenID "phone home" and report your movement across the web.

Persona was explicitly designed to be privacy preserving.

> Second question, if an attacker knows my Yahoo password, can he potentially login to _all_ Persona-powered websites with my email then?

Yes, if an attacker has your yahoo email address and password, they can log in as you. BUT, you can take advantage of two factor auth from Yahoo as well as other security features they provide, to keep yourself safe.

[ Parent | on HN ]

Re:New Persona Beta: Millions of Users Ready to Log In using... by badida on Tuesday April 09, 2013 @02:02PM (#5519863)

No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona.

However, if you use the "login with Yahoo" button (or Google or Facebook), then yes, they can track all of your activity.

To your second point: great question! No, the attacker cannot. We still protect your other email addresses with a Persona password.

[ Parent | on HN ]

Re:New Persona Beta: Millions of Users Ready to Log In using... by badida on Tuesday April 09, 2013 @02:03PM (#5519872)

Oh wait, I misread your point. Yes, the attacker can log into all Persona web sites if they know your Yahoo password. But that's the way the cookie crumbles with federated identity. It's the same thing if you pick a Yahoo email address as your recovery email. Pick your identity providers wisely!

[ Parent | on HN ]

Re:New Persona Beta: Millions of Users Ready to Log In using... by human_error on Tuesday April 09, 2013 @07:46PM (#5522262)

> Yahoo only knows that you're using your Yahoo identity with Persona

But Yahoo still knows that I'm on that website.

[ Parent | on HN ]

Re:New Persona Beta: Millions of Users Ready to Log In using... by ozten on Tuesday April 09, 2013 @08:58PM (#5522544)

How?

[ Parent | on HN ]

Re:New Persona Beta: Millions of Users Ready to Log In using... by megaman821 on Tuesday April 09, 2013 @02:43PM (#5520200)

Isn't the second question equivalent to what we have now? If an attacker knows my Yahoo password, can he potentially reset all the passwords of sites I registered with using my Yahoo email address and login to them.

[ Parent | on HN ]

Re:New Persona Beta: Millions of Users Ready to Log In using... by ozten on Tuesday April 09, 2013 @03:52PM (#5520788)

Great point. Previously discussed on HN, but this story paints the picture of the world we're already living in http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-hona...

[ Parent | on HN ]

Re:New Persona Beta: Millions of Users Ready to Log In using... by city41 on Tuesday April 09, 2013 @02:22PM (#5520004)

Email accounts are almost everyone's achilles. Even without Persona, the attacker could still go around to websites and request password resets if they have access to your email.

[ Parent | on HN ]