News for hackers. Stuff that matters.

A comment on New Persona Beta: Millions of Users Ready to Log In using Any Browser. Parent comment

Re:New Persona Beta: Millions of Users Ready to Log In using... by badida on Tuesday April 09, 2013 @02:02PM (#5519863)
No, because Persona mediates, and Yahoo only knows that you're using your Yahoo identity with Persona, nothing more. That's a key privacy property of Persona.

However, if you use the "login with Yahoo" button (or Google or Facebook), then yes, they can track all of your activity.

To your second point: great question! No, the attacker cannot. We still protect your other email addresses with a Persona password.

[ Parent | on HN ]
Re:New Persona Beta: Millions of Users Ready to Log In using... by badida on Tuesday April 09, 2013 @02:03PM (#5519872)
Oh wait, I misread your point. Yes, the attacker can log into all Persona web sites if they know your Yahoo password. But that's the way the cookie crumbles with federated identity. It's the same thing if you pick a Yahoo email address as your recovery email. Pick your identity providers wisely!
[ Parent | on HN ]
Re:New Persona Beta: Millions of Users Ready to Log In using... by human_error on Tuesday April 09, 2013 @07:46PM (#5522262)
> Yahoo only knows that you're using your Yahoo identity with Persona

But Yahoo still knows that I'm on that website.

[ Parent | on HN ]
Re:New Persona Beta: Millions of Users Ready to Log In using... by ozten on Tuesday April 09, 2013 @08:58PM (#5522544)
How?
[ Parent | on HN ]