So what happens when my Person account gets compromised?
I'll stick to my many accounts / many passwords approach, I think.
I'll stick to my many accounts / many passwords approach, I think.
Any account will be compromised - it's only a matter of time. When that happens, it's best (as recent articles in Wired, Ars Technica and others demonstrate) to have a broad account "ecosystem".
What about Facebook/Google/Twitter Sign In buttons - do you think Persona is an improvement over those?
Edit/update: if compromised, you loose all linked accounts, however, with google/fb/.... it is the same, but this is less leaky to 3rd party, if this comes as default login, then we would have only a dozen of logins (persona/email, + important accounts, e.g. banking something similar... ), not ~100 of them, thus resetting 100 passwords is just 1 action
If you say you use multiple email accounts, then you can also use multiple Persona accounts. In fact, support for multiple accounts is part of the plan.
I don't see how introducing a single untrusted third party, many accounts or otherwise, is better than using a couple of trusted third parties such as gmail and hotmail.
i actually don't think this argument holds water.
it's the same with any auth system. you can use 2FA, etc. in the end if someone compromise your laptop you're screwed, they get all the passwords/assertions anyway.
They can't make assertions from the server side.
I think I'll stick with my 20 doors with 20 locks.