Comment by coherentpony | Hacker News Reader

Comment by coherentpony | Hacker News Reader

Parent Full thread

>Also it will in theory work as a browser extension, so your email provider sends your browser the token, and your browser sends the token to the websites you log in to. So your email provider doesn't know where you're logging in.

I don't understand this. Presumably there's nothing stopping Website X sending both: a) my email address; and b) Website X's URL.

Scenario: Joe Bloggs tries to log in to www.SiteThatSellsCars.com using Persona. Joe enters his email address. SiteThatSellsCars sends Joe's email address and "www.SiteThatSellsCars.com" to Joe's ISP. This translates to SiteThatSellsCars saying, "Hey, Joe's ISP, Joe is looking to buy a car, you should send him a metric shit-load of car adverts. He might not like it, but whatever. Thanks for the $20!". Then Joe's ISP replies with, "I sent Joe a token to his browser so he thinks he still has his privacy, but fuck him. Every customer you tell us about, we'll give you $20."

Perhaps I am being cynical.

The site doesn't send anything at all to the identity provider. Your browser sends an authentication requests to the identity provider and relay it the site it wants to log into.

The site then checks the request is really signed by the identity provider and lets the user in.

The identity provider knows two things:

- You asked to log in somewhere - At least one person logged to site X because site X asked for its public key

> I don't understand this. Presumably there's nothing stopping Website X sending both: a) my email address; and b) Website X's URL.

Yes, but there's nothing stopping them from doing that today. Persona doesn't help you if the site you sign into can't be trusted with the identity you give them. But nothing requires you to give them your normal e-mail address - you could just use throwaway if you find that a concern.

This is not what Persona tries to fix.

Persona is single sign-on where the identity provider does not know which site you sign in to, unlike current solutions where e.g. Google, Twitter or Facebook knows where you sign in whether or not the site you sign into is trustworthy or not.

redalastor is correct. Joe's browser asks Joe's ISP for a token... Joe's ISP never knows what site it's for.

It's more like a client certificate issued by your email provider and installed ad-hoc on demand, rather than a typical Central Authentication System.

Reply on news.ycombinator.com