Open Letter to Mozilla: Bring Back Persona - <AUTHOR> http://www.stavros.io/posts/open-letter-mozilla-bring-back-persona/ <comment><USER3> I hate that the best user experience for logins is "Login with facebook" or "Login with Google". I don't want to impose that privacy failure on my users, but I also don't want to impose the annoyance that is "Sign up with a username, email address, and password". Offering all of the options is also a compromise that complicates the user experience.

Now, here's the sad thing, for me: I didn't even know Persona _existed_ until its demise was being discussed on HN and reddit. Persona is exactly what I want for my users and my sites; and for my own use of the web. And, I didn't even know it was an option until it stopped being an option.

In short: I strongly agree. Mozilla has to focus resources on areas where it can have the biggest impact on privacy and the open web. This is one of those areas.

I hated to see Thunderbird dropped from the Mozilla roster, as it is my mail client of choice, but I understand where they're coming from. I hated to see FirefoxOS end, but I never got to use it, and it seems to have been doomed from the get-go by poor market fit and difficulty competing with the three biggest tech companies in the world in a market where money and influence play a role in which devices get into users hands. But, Persona is exactly the right kind of thing for Mozilla to be doing, and there's no reason they can't do it effectively, and without a huge amount of resources.

<comment><USER4> Side note: usernames should just be emails these days, they're unique and save all the effort of needing another made up name.

<comment><USER5> Theoretically yes, but it's not as simple as that. Every identity can have more than one email associated with it, and emails can change over time. So "username == email" is fine as long as the concept of a username mutating is fine.

<comment><USER4> I don't see a problem, it just means you can login with multiple emails then. They're still unique to you. LinkedIn and Facebook and other services already do this.

A username/real name can still be used as the "name" if this is an online community or something similar.

<comment><USER6> LinkedIn and Facebook can do this because your email is not your username. There likely isn't really a username in those systems, just a user id. Almost all systems have a user id, but the distinction here is slightly different. Instead of a user record which has an id, username and possibly full name, Facebook likely has a user record with an id, a (display) username, and then there is a separate set of auth records with the multiple ways you can authenticate to the account, such as emails and passwords, API tokens, phone numbers, etc.

It may not sound like a big distinction, but there _is_ a big distinction there. Instead of your username being your email address, they've abstracted the authentication from the core user record such that usernames are not used for authentication, so don't have to mutate if the authentication identifier (email address, phone number) changes, just some auth settings. This is obviously a much more extensible and robust way to deal with authentication over time, but it's also obvious it's much more complex than a simple username/password pair.

<comment><USER7> You are describing the tripartite identity pattern: [http://habitatchronicles.com/2008/10/the-tripartite- identity...](http://habitatchronicles.com/2008/10/the-tripartite-identity- pattern/)

<comment><USER6> For the most part. My example was more a bipartite pattern, because I was covering the authentication aspects, not the entire identity structure (which I believe Facebook and LinkedIn would implement as the article outlines). For a system where you don't need to track multiple social identities, and where you interact within that system through your identity on that system, that's probably enough.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor <3), and I have implemented Persona on _many_ sites. This is all just my own personal opinion.

I was very bullish on Persona early on, but the fact of the matter is, _we failed_. And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product.

We failed for a thousand reasons. It should've been supported directly within the Firefox chrome ASAP. It had branding different than the site you logged in to and was in a popup[1]. It took the name of another Firefox feature that users already knew about. Because the team was experimenting fast, the code quality of the service was such that outside contribution to it (or even cross-team contribution internally) was hard to impossible. There was no (or very limited) metadata available for things like a shared avatar or display name.

We had enough time to do these things, but we didn't. The team accomplished something really amazing, but it wasn't enough, and most importantly, _putting more effort into what already existed was not going to work_. This idea that Mozilla can just turn around and throw effort at Persona and make it win now is, IMO, wrong.

Identity needs more experimentation, that much is certain. But harping bringing back Persona in particular is beating a dead horse. We need a successor or a new project.

[1] Not only did this make Persona look _incredibly sketchy_ without a lot of priming users, it had a major privacy issue of leaking your identity provider and relying party to Mozilla via a centralized iframe we host. A mailing list thread among the Persona devs and community failed to find a solution to this.

<comment><USER5> I agree with you on most of this. And yes, a "Persona 2.0" should really just take the Persona lessons and learn from them, avoid the mistakes.

That's also why I mentioned in my other reply that I'd be willing to help a project that has a chance to succeed - and that means being lead by someone who has themselves learned all the lessons from Persona. Someone who was on the original dev team.

But this also needs backing from Mozilla, or a corporation like mozilla (there aren't many).

While a lot of devs, including Mozilla devs, agree that Persona needs a successor... there's no sign of any such backing.

<comment><USER9> > (there aren't many)

Because this is so important maybe it should be left to just one entity to run. Ideally a federated identity login thing should be backed by a plethora of orgs.

Let's make a list?

Redhat, Linux Foundation, Raspberry Pi, Ubuntu, Mozilla, LibreOffice, Eclipse, GNU, ... ?

<comment><USER5> I could see a joint effort, similar to what happened with Let's Encrypt. The players who benefit are different though so it's harder to get the same kind of pull.

</comment></comment></comment></comment><comment><USER5> > _I don't know if something like a Kickstarter campaign to raise some money > to pay for engineer time would help sway Mozilla at all, but I'm perfectly > happy pledging a few hundred dollars and running the campaign, if necessary. > I just really want to see Persona succeed._

I mentioned this by email, but I'll repeat it here:

I believe in the design behind Persona. I believe a well structured, free authentication provider, is one of the core pillars of a _free web_ , which is exactly what Mozilla claims to stand for.

I believe in a free web and I'm also willing to put my money where my mouth is. I'm ready to pledge not just my money but my time. I am willing to volunteer my skills as a developer, UX designer and my experience leading FOSS projects to Persona, or a Persona-like project that has a chance of succeeding. If you are involved in this, feel free to email me (see my profile for a point of contact).

I invite others willing to do the same to say so here.

<comment><AUTHOR> Did I ever get back to you on that with the update?

For people not in the loop: I would also like to pledge my time in developing a Persona or Persona alternative. I'm just a bit apprehensive on such a project's chances if it weren't backed by a big company like Mozilla. Then again, maybe we should just go for it.

<comment><USER5> You did not :) Have you talked to Dan Callahan yet?

</comment></comment></comment><comment><USER10> Anyone who wants to see a demo of it, just sign-in here (top right): [https://login.persona.org/](https://login.persona.org/)

Anyone who wants to see how easy it is to deploy (JS on your page, a button, and callback verifier on your server): [https://developer.mozilla.org/en- US/Persona/Quick_Setup](https://developer.mozilla.org/en- US/Persona/Quick_Setup)

Anyone who wants to see it in action: [https://www.lfgss.com/](https://www.lfgss.com/)

I love everything about Persona except for the fact that Mozilla are no longer supporting a team around it, and it was given to the community in almost an abandon-ware fashion.

The idea that this could have made an impact faster is laughable, choosing an auth provider is such a slow process requiring considerable points of trust to reinforce it... one of the most significant points of trust was Mozilla itself, but it also needed a social reinforcement as more people adopted it. Mozilla didn't give Persona the time it needed.

My criticisms of Persona are nothing to do with the fungible nature of email as identity, which I think is OK enough in principle (it's no less identifying than anything else and changes less frequently than a phone number), but to do with:

1) The way Persona wants to centrally log-out from all sites, when a user's experience is that they can sign-out from one site and remain signed-in on another.

2) The lack of 2FA in the default instance they shipped/supported.

3) Some of the phrasing and language confuses users, especially after changing to Persona. i.e. They were still a user on my site identified by email address, but Persona would declare that they were not recognised... so I'd have to spend time telling the user to ignore that and sign-in anyway.

The core product though, was exactly what the web needed, and exactly what I needed for all of the sites I run.

<comment><AUTHOR> To address some of your points:

1) That is completely controlled by the site owner. In my sites, for example, I just disabled the Persona JS while the user was logged in, so there was no global log-out possible.

2) I believe the bridge was just a proof of concept, with the intention of email providers supporting Persona directly so all the security could be implemented there. I know you said "default bridge", but my side-project here supports 2FA: [https://persowna.net/](https://persowna.net/)

3) That is very true, some UX changes were necessary, but imagine if the browser itself could just pop up a window saying "do you want to log in to this site using your email address? Yes/No", done.

<comment><USER11> If you're so supportive of Persona, why don't you make your work in the area (persowna.net) FOSS?

<comment><AUTHOR> I just might.

</comment></comment></comment></comment><comment><USER12> Mozilla shutting down Persona was one of my biggest internet-related disappointments this year. It seemed like the perfect OpenID replacement (that might actually get used by normal people). Bring it back please!

</comment><comment><USER13> I've hit the upvote button, tweeted Stavros that I think this is awesome - <USER2> I still want to document my support with a post.

I don't have a FB account and don't use my Google account a lot. I should really delete the latter.

But it would be so much easier with Persona. Yes, a lot of sites won't adopt it, at least at first. But with a well supported alternative that I want to use, I'd have an easier time to say "fuck it" and close the browser window.

Right now I'm trying to go for the next best thing: Different accounts per service (vs braindead "Log in with Silicon Valley Corp").

Alas .. Persona would simplify my password store a LOT. I'd back a campaign. Not sure if I could offer hundreds of dollars, but let me state here that I'd find a way to add 50-80 right away/as an incentive to adopt the project again and I definitely would be able to contribute a recurring amount (a la Patreon etc) for the ongoing development.

</comment><comment><USER14> For more (and better) counter arguments, start with this thread (which was about one particular comparison with Facebook Connect: possibly click to see the parent for context) and then follow my chain of earlier comments I link at the bottom of that one (which were more general, going into the flawed assumptions in Persona about email).

[https://news.ycombinator.com/item?id=7243172](https://news.ycombinator.com/item?id=7243172)

(By the way, I am going to try to avoid wasting even more of my life arguing on Hacker News about the benefits or lack thereof of Persona, so I am dropping these links here to maybe seed discussion among others, but I am going to attempt to avoid ruining my Christmas Eve by forcing myself to never look back at this particular thread again ;P.)

Also, for anyone wondering if I have anything credible to say on this subject before bothering to read any of this--and maybe to the one person who downvoted me from 3 points to 2 points, which I noticed as I fleshed out the "I will hopefully leave" message ;P--I have run a service with tens of millions of users that _only_ uses federated login (though accounts are optional, so I "only" have just over ten million accounts on file), and have been staring at this space since 2001, when Microsoft announced Passport (at the time, I even was thinking of starting my own single-sign-on service, but was a naive college student ;P).

(later edit: I found another old thread on this subject that I am going to add here as an edit, mostly because any other way of adding it might cause me to see if there are any responses to this comment ;P. At the time, to this new link, there were two responses I hadn't bothered seeing and responding to: one from someone who insisted upon comparing the fundamental bug in Persona with an existing "worst practice" (as opposed to any of the better alternative options), and one who seems to be in left field assuming the value of a Facebook account is based on whether the user updated their email address: the point I was making is that Facebook isn't actually tied to email addresses, as they "understand" the problem inherent in relying on them for anything, and so users do not run into any of the issues that Persona not only doesn't solve but actually makes worse. Regardless, yeah: even without reading any comments from today I am already spending way too much time at this ;P.)

[https://news.ycombinator.com/item?id=8250301](https://news.ycombinator.com/item?id=8250301)

<comment><USER15> While I agree that dealing with lost/defunct email addresses and thus accounts can be a challenge there may be other solutions to these (e.g. SMS confirmation, backup pass phrases). In any case it seems we're letting the perfect be the enemy of good with this line of argument. Persona provides significant privacy and perhaps security to alternatives.

<comment><USER16> The problem at that point becomes you start to implement a service, rather than a protocol. I'm not sure there is necessarily a solution for identity with the way email is currently implemented.

</comment></comment></comment><comment><USER17> I created this Persona Advocacy mailing list 11 months ago, but didn't get any traction:

firstname.lastname@example.com

[http://librelist.com/browser//persona.advocacy/2015/1/24/the...](http://librelist.com/browser//persona.advocacy/2015/1/24/the- mozilla-persona-advocacy-mailing-list/)

You can subscribe by sending an email to (first message is ditched):

        email@example.com

</comment><comment><USER18> I was an early adopter of Persona (my site is billed as example in the docs) and was similarly disappointed when Mozilla gave up on it.

In retrospect, I think that Mozilla made a mistake by centralizing the fallback identity provider. The fallback provider was just a temporary edifice to bootstrap the protocols; it didn't have to be run by Mozilla. Every website could have run a small stack which remained fully self-branded and would only verify email addresses for its own purposes.

I understand why Mozilla took the route they did - centralizing the fallback provider eased the RP implementation, made it possible to rapidly rev the protocols, and in theory made it more convenient for users since one Persona password would work across multiple sites. In practice, however, users were confused about the extra branding and the vague sense of logging into Persona so you can log into a site. More critically, it made the whole project depend on the whims of Mozilla - it's not just software we depend on, but _infrastructure_ , and without Mozilla's support the infrastructure will eventually die.

If Persona is revived, I hope it becomes a complete software stack that every RP can run independently. The fallback IdP should be 100% branded by the RP so users are never confused about what site they are logging into. And as non- hosted software, it should be able to live and evolve as open source software without fear that some tepidly supported server will go down (or simply fail to evolve). IMHO, this is the only way that Persona (or at least the auth standard, which is what we care about) can survive long-term as a community project.

</comment><comment><USER19> The main problem with Persona was not the tech, Persona is great and works well. The problem is that building federated identity services is hard. Persona is not a centralized login system such as "login with Facebook". With Persona, once you decide to login with your email account, first Persona looks for an IdP with your domain/provider, the if not found it goes back to the persona catchall service. For a while gmail.com had support for Persona as well and it worked transparently. I don't know if that is still the case.

What killed Persona was not tech but the lack of traction. Developers loved it but failed to use it. By providing options such as FB, Google, Twitter and other logins, the user choose the familiar service and never tried Persona. In the end, the lack of traction together with the overall difficulty of building federated identity services killed it.

But what is dead cannot die! Persona still works, I still use it every day in lots of Mozilla properties and if I had to build some service that required logins, I would use it even today. It is in the hand of the community but with some care and more traction this can become cool again.

I will look into the source code and see if I can help somewhere.

<comment><USER20> > What killed Persona was not tech but the lack of traction. Developers loved > it but failed to use it.

The idea was always that Mozilla would ship native integration in Firefox. There were very very pretty mockups going around and everyone was holding their breath for that to happen.[1] Even announcing they would ship it in the next version would mean 1) it's stable now and 2) Mozilla is behind it.

My guess is Google (their sponsor at that time) made them drop it because they were preparing to launch G+.

I know it's a conspiracy theory, but it frankly makes more sense than all those other non-reasons I keep hearing about in this thread.

[1] [http://www.extremetech.com/wp- content/uploads/2011/07/firefo...](http://www.extremetech.com/wp- content/uploads/2011/07/firefox-account-manager.jpg)

<comment><USER21> I agree. Some people in this thread are saying Persona is not dead because it's still up... but without the browser integration (which never was arrived), it's not even half as good as what it could be, and without Mozilla endorsement, it's not going to get serious adoption.

</comment></comment></comment><comment><USER22> I don't really see the point in this and this is why: let's say Persona won and all the big ones switched to it (Facebook, Google, Twitter etc.) by becoming providers. Most people would still be using their Facebook, Google or Twitter persona anyway (except for a few privacy sensitive users who don't like SaaS anyway because it's bad for privacy according to them). So we would have a situation that would be de facto very similar to what we have now (3 sigin buttons for facebook, google and twitter) and then an extra one for people using their own hosted provider. This is what happened with OpenID, problem was that supporting people using their own providers became a nightmare as these providers went down or had some incompatibilities. People were just angry they couldn't sign in with their old providers, many of theme may have not even known they were using custom providers or what providers are and the other half would be privacy nerds who enjoy complaining every time their custom provider stops being fully compatible. For app owners, it would just be a big waste of time and resources supporting these users.

<comment><AUTHOR> You misunderstand how Persona works. You can't log in with Facebook or Twitter, because they don't provide your email address. You can log in with an email address, and the email provider doesn't know what sites you're logging in to.

Try [https://pastery.net](https://pastery.net), log in there. If you have a Gmail account, you'll just click "accept" and you're in.

<comment><USER22> I just tried it and it redirected me to google oauth2 dialog. Same thing. If anything, it's one step more than using google's oauth2 directly.

</comment></comment></comment><comment><USER23> Even though I didn't use Persona, having read this, I think this is a big WTF moment for all of us, not just Mozilla. Now I want this thing I didn't know existed because I have, and have had, a need for exactly this. I use a password manager, but I don't really want to use one. I certainly don't like my parents using them, because in fact I have to use them for them because the UI/UX varies so much among web sites. There is no standard UI for changing passwords or doing account resets. All of that shit could go away with this. Fuck. We need to go retrieve that ship!

</comment><comment><USER24> I find Keepass and/or Lastpass are better solutions - you can have different logins for different sites, generate truly strong random passwords and login with two clicks in any modern browser.

I don't want Google (or God forbid, Facebook) knowing what sites I login to and part of my credentials, and I don't want websites to know my email address.

I know you say they don't have this information, but it's not hard to get access to it if they feel they want to. Google Web History already creeps me out :-)

I also feel more secure with different passwords (and even emails) on different sites.

<comment><USER25> > Google Web History already creeps me out :-)

You know that you can turn off most of their tracking by doing a privacy checkup? I can't guarantee that they don't know a lot about me and that they're still not tracking me, but I can guarantee you that my Google history is completely blank.

<comment><USER20> Do you actually believe this accomplishes anything… This data is still in their server logs[1] (and streamed directly to NSA).

USE TOR BROWSER FOR BROWSING. DON'T STAY LOGGED INTO GOOGLE. Anything less is just a waste of time.

And seriously, Tor in 2015 is fast enough for 1080p h.264, there's really no excuse.

[1] [https://nakedsecurity.sophos.com/2011/10/20/law-student- trig...](https://nakedsecurity.sophos.com/2011/10/20/law-student- triggers-22-legal-complaints-and-likely-audit-of-facebook/)

</comment></comment></comment><comment><USER26> As I understand it, the main point of Persona was improving the situation around authentication and passwords.

Now, I'm seeing indications that Mozilla is working on implementing FIDO U2F support ("Mozilla's commitment to add FIDO U2F support to the Firefox browser").

[https://www.yubico.com/2015/12/2015-was-a-yubico-rocket- ride...](https://www.yubico.com/2015/12/2015-was-a-yubico-rocket-ride/)

That seems like a much better approach to improving the situation around authentication and passwords than Persona was.

</comment><comment><USER27> This might be a silly question, but why do we need Mozilla to build this system? Is it a matter of trust in Mozilla and a greater likelihood of adoption if Mozilla is the organization providing this service?

<comment><USER28> > _Is it a matter of trust in Mozilla_

Yes. Mozilla has helped bring a large number of Web-related standards while maintaining consistently high privacy and security requirements.

Note that Persona isn't a one-central-service system, though. You can have a ton of identity providers, assuming they all follow the same standard. You do need one service to get started, however.

</comment></comment><comment><USER29> Please, don't.

Persona is an inherently bad protocol that continues the unnerving trend to shift the concept of _identities_ from something that's owned to something that's merely leased and temporarily granted.

It's better than "Login with $Provider" in a sense that $Provider doesn't get the data, but it's equally worse in a sense that $Provider still owns your identity.

I wrote about it here: [https://news.ycombinator.com/item?id=10595347](https://news.ycombinator.com/item?id=10595347)

<comment><USER30> Could you suggest a usable, practical alternative then?

It seems from the other thread that you believe WebID to be a better alternative to Persona/BrowserID. How practical and usable is it right now, and what key advantages does it offer in your opinion?

<comment><USER29> Sadly, no alternative currently exists. Well, none I know of.

There were some attempts like WebID and gpgAuth, but none is usable at the moment. They have to be dug out of dirt of oblivion, carefully analyzed and improved with important features they're missing to be usable for ordinary people (at least key escrow and sync - both completely optional, of course).

What I want from authentication system, is complete independence and full and ultimate control and ownership of my own identity. I don't want to trust, depend or even need any third party just to have account with someone. Not even if this third party is a domain name registrar, not even if I have a legal agreement with them.

When we had just usernames and passwords - it was exactly like that, except for mandatory emails thingy (but that's another story). I met someone, we introduce yourselves, negotiate a shared secret - and we're now acquaintances. With OpenID/OAuth/SAML/JWT/Persona this is no more the case - we have to call a notary and the notary will tell us who I am. And I really don't like this and want to see this fixed.

I want to revoke any possibility of any third party to revoke or otherwise deny my identity. They may assert my identity (say they know me and I'm a good lad) and revoke their assertion about my identity (i.e. say they don't trust me anymore), but not the fact who I am.

</comment></comment></comment><comment><USER31> I've used Persona on one project (see: [https://github.com/OWF/owf2014/blob/master/website/auth/pers...](https://github.com/OWF/owf2014/blob/master/website/auth/persona.py)). I was awesome (much much easier than the OAuth dance with the various providers we wanted to support). I wholeheartedly agree w/ Stavros.

</comment><comment><USER32> > As security people like to say, "put all your eggs in one basket and stick > the basket in Fort Knox"

I'm not so sure I want to do that. The point is, even that single Fort Knox can be breached at some point, and if it is, then everything is lost.

I agree that nowadays, email is almost unanimously the way to verify a password reset, and hence all your eggs are already in one basket, but shouldn't there be further protections?

<comment><USER33> > "I agree that nowadays, email is almost unanimously the way to verify a > password reset, and hence all your eggs are already in one basket, but > shouldn't there be further protections?"

A few of the major webmail providers offer two-factor authentication, so that's one option to enhance protection. Here's some information about how to enable it for Gmail, Hotmail and Yahoo Mail:

[https://www.google.com/landing/2step/](https://www.google.com/landing/2step/)

[http://windows.microsoft.com/en-gb/windows/two-step- verifica...](http://windows.microsoft.com/en-gb/windows/two-step-verification- faq)

[https://help.yahoo.com/kb/SLN5013.html](https://help.yahoo.com/kb/SLN5013.html)

</comment></comment><comment><USER34> Persona is a neat idea, but there's a better one: get rid of password logins altogether. I should just be able to enter my email on ANY site, and they'll send me an email with a login button. I click the login button in the email, and am automatically logged into the site for as long as necessary.

It's exactly as secure as the "Forgot my password" reset nonsense, but streamlined to be way easier on the user. Then you only need one password: the one to your email. This removes the need for Persona to "add support" for different email providers. Your provider doesn't matter, just the fact that you can receive emails!

I'd really wish more sites would just do this anyway. For instance, every time I get an analytics daily report from Fabric.io, I click the link in the email, and it asks me to login. WHY ARE YOU ASKING ME TO LOGIN, WHEN I JUST CLICKED AN EMAIL YOU SENT ME? It's obviously me!

<comment><USER21> If you have an identity server, a website and a browser that all support Persona, (and you've already been through the process once), Persona would work much better than that. You don't have to memorise a new password and you don't have to click on a verification email. You just land on a new site, click log in with Persona, choose your email address, and TADA! you're in. And the beauty of it is that your email provider doesn't even know which sites you're logging in to.

</comment></comment><comment><USER35> While I think Persona is way better than password-based auth, I can't help but feel that it's also a sideways step. No, authentication should be provided by the user-agent, not by some third party identity provider (even if you control it by running your own). We have this for ssh: you have your private ssh key and it's up to you to manage having it in the right places (work desktop, laptop, phone, etc.) It's clunky, but that's OK: it's aimed at tech people.

Browsers should do something similar: provide a storage for private and public keys as proof of identity. But they should additionally provide a way to sync those identities across multiple browsers and machines. This latter concept will be familiar to anyone who has used LastPass. The former, well it should basically be a dropdown with your identities, and you choose one before clicking the "Login" button.

<comment><USER36> To some extent, this is similar to SSL/TLS certificates that can be used to authenticate the user (not just the server). If I recall correctly, [http://startssl.com/](http://startssl.com/) does that.

It's not a very intuitive mode of authentication, but if the UI was improved, and combined with a sync service (& encrypted with a passphrase), I guess it could be usable? (also, presumably it requires the site to use https, but that's also much more expected today than it was 10 years ago)

<comment><USER35> Yeah, basically this. I have used it before and client side TLS certs are anything but intuitive. They are also not widely supported.

</comment></comment></comment><comment><USER37> _> Anyone with access to your email account can simply reset any password on any site. The right solution is to make your email account very, very secure._

No, the right solution is to stop using email as sole identification for password resets. Yes, there are other solutions you can implement right now without waiting for some big company to save you.

The most obvious one it to create a second factor of authentication _just for account resets_. It could be via an SMS _OR_ simply by asking user to print out/write down a special randomly generated "reset" number.

"But SMS costs money!" No, for most providers you can send an email to a special address reserved for the phone number. It will get translated to SMS automatically.

"But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. You don't expect them to loose access to their email, but that happens all the time.

<comment><USER38> SMS is an awful point of failure to inject into a protocol. It is plain-text, monitored in many countries, and can be unreliable and expensive in emerging markets, and just no.

"But users will forget/loose their reset number!" Maybe, maybe not. It's a cultural thing. Really? Can you cite anything here that indicates this is the case?

Users treat email access differently, seeing as how it's bound to user identity, usually across dozens, if not hundreds of services.

<comment><USER39> SMS though provides a higher level of security. Some hacker anywhere on the planet could have accessed my email and passwords but they can't get a code sent to my phone unless they are nearby and have got hold of the phone. I'm not sure it being plain text and monitored matters much as all that's bring sent is a random number usually. I'll admit it could cost more and so may not be the thing for sites with lots of free users. If you can't get sms some sites will phone you with a recorded message.

</comment></comment></comment><comment><USER40> \- Can Mozilla set up a kickstarter for this project?

\- Is it technically possible to create a Bash/SSH integration? The Linux world pretty much has SSO now, it would be an awesome argument to have this and Persona extend each other.

<comment><USER41> The client that wants to login always needs to execute a browser (or at least a render and JavaScript engine). See this (stalled) proposal to make it more compatible with non-browser/simpler agents: [https://groups.google.com/d/msg/mozilla.dev.identity/L2ETKkd...](https://groups.google.com/d/msg/mozilla.dev.identity/L2ETKkdMv8g/q3ffwFaJgl0J)

<comment><USER42> Well, we had Persona working as both as GSS-API mechanism on Unix and a SSP on Windows. You could use it to sign-in to Exchange with Outlook - that was pretty cool. Links here:

* [https://hacks.mozilla.org/2013/04/mozilla-persona-for-the-no...](https://hacks.mozilla.org/2013/04/mozilla-persona-for-the-non-web/)

* [https://github.com/PADL/libbrowserid](https://github.com/PADL/libbrowserid)

* [https://tools.ietf.org/html/draft-howard-gss-browserid-07](https://tools.ietf.org/html/draft-howard-gss-browserid-07)

</comment></comment></comment><comment><USER43> Not sure if anyone realizes this, but Mozilla is not really an open source thing. It's a company that happens to be a nonprofit. It deploys resources and runs itself like a Silicon Valley company.

It's not just a bunch of dudes in their basements writing code. They have like $330 million in annual revenue. They are sitting on like $90 million in cash.

Mozilla isn't about software for its own sake or just for the sake of the web. They are about self preservation and Persona wasn't going to keep them alive, so they killed it.

Mozilla is a company. That is what companies do.

<comment><USER44> I've got plenty of quibbles with Mozilla (including their handling of Persona) but "open source thing" and "company" are not mutually exclusive. We need more entities with lots of resources doing almost exclusively open source.

</comment></comment><comment><USER45> We've had 10+ years now of failures to build a proper federated authentication system (RIP OpenID). The problem isn't technical, and it's only a little bit product design. The problem is political. The big companies with the influence to support a system like Persona don't want it. Facebook, Google, etc believe they can own identity on the Internet themselves, so they won't support a neutral identity provider. Which is a terrible situation for users.

Mozilla absolutely is the right kind of organization to try to attack this Gordian knot.

<comment><USER46> I totally agree with the first paragraph, but I'm not convinced on the second.

Mozilla is right in the sense that they're independent and a not-for-profit. But they're also small relative to the other players, with more limited resources. They also just don't seem to be very good at politics and/or building business partnerships.

In particular here they seemed to solve it as mainly a technical problem. They apparently launched it with the assumption that its existence alone was sufficient to generate uptake, which even at the time seemed naive to me. And then after a while they shrugged, said, "looks like it doesn't work" and closed it down. That doesn't seem like the right organization to me.

<comment><USER45> I agree the Mozilla organization has failed here. I guess I don't know any other neutral organization that could do this. We have precious few user- advocacy organizations out there. It's outside EFF's bailiwick. I don't think Apache is any better at politics than Mozilla.

</comment></comment></comment><comment><USER47> Is there a short introduction as to how Persona deviates from the original decentralized OAuth approach? I'm a bit unclear why what didn't work for decentralized OAuth should work for Persona.

<comment><USER48> What was the decentralized OAuth approach? Are you referring to OpenID?

If so, the difference is that Persona works with whatever email address/account the user already owns, just like plain email/password authentication; they don't have to figure out that they need to create an account in some "identity provider", which then gives them an URL to copy- paste into the site.

</comment></comment><comment><USER49> The best way to get Persona adopted would be to have someone significant _other_ than Mozilla to adopt it. If IE, Safari, or Chrome had adopted, it would have had a great chance at success.

<comment><USER19> Just to be clear, Persona works on IE, Safari and Chrome as well. It is not tied to Firefox. You can login to MDN for example using Persona on Chrome if you'd like to.

</comment></comment><comment><USER50> It's alarming that after 2 years they killed it off for lack of traction, and not only that, decided they had failed.

How could they have possibly succeeded in that timescale? They seem to think there were flaws with Persona, and that's true, but those flaws could be fixed. Making a few mistakes on an attempt doesn't mean you should kill it off if the basic product works well. It means you fix them. Starting a new Persona is silly, Persona itself works.

</comment><comment><USER51> It's nearly 2016 and Firefox can still only using 1 of my 8 CPU cores, and I can still bog down the UI with heavy web apps. My favorite email client is no longer supported, and now a potentially great privacy tool is being dropped. Meanwhile, after wasting countless man hours on a Mobile OS, they're now "pivoting" to IoT.

Why can't they just focus on what people value them for, web browsers and privacy?

</comment><comment><USER52> > Even if your email provider does end up getting breached, you only need to > change one password to be perfectly secure everywhere again.

I liked the article, but this is not true - if a service gives out password reset tokens or log-in-via-emailed-link tokens, a breach of your e-mail will still require a reset on that service. Even in a fully Persona'ified world, such tokens are likely to exist for at least some services.

</comment><comment><USER53> Persona seemed like the right identity product for its time, but technology has moved on in the years since. We now have blockchains: shared, publicly- writable databases that are perfect for hosting identities that users fully control. Figuring out decentralized identity is part of my day job, and if it's something you're interested in building or talking about, email me: email@example.com.

</comment><comment><USER54> You're right. I sent Mozilla $5 this year just for doing what they already do. Kickstart this and they'd get millions, I'd guess.

</comment><comment><USER55> >Tell the email provider you want to give a site permission to know your email address, without telling the provider which site it is.

Then the site emails you anyway. (If you didn't want them to, you shouldn't have given them your email address).

<comment><USER56> The email could be used for authentication purposes and not for actual email.

</comment></comment><comment><USER57> If someone at Apple is reading this... please fork it (or built up from scratch) a solid open source SSO system and become an official (but optional) identity provider for your millions customers.

This would be a win-win as this could help AppleID and TouchID becoming even more central for your users while demonstrating at the same time that you care about privacy and are willing to develop an open standard to support strong and distributed identity management system as an alternative to Google and Facebook centralized and privacy unfriendly solution.

</comment><comment><USER58> [https://indieauth.com](https://indieauth.com)

Of course domains aren't as popular as email addresses, but OpenID used domains… This is like OpenID done right.

</comment><comment><USER59> I backed persona with a well written example back when it first 'came out' into the mainstream: [https://github.com/sergiotapia/ASP.Net-MVC3-Persona- Demo](https://github.com/sergiotapia/ASP.Net-MVC3-Persona-Demo)

It was super easy to integrate, better UX in my eyes, but Mozilla just shut it down for some reason. It died down.

I hope they assign more resources to it. I hate having Facebook sign ins on my website.

</comment><comment><USER60> As a dev, it was really nice to use Persona and not have to build an authentication system for each project.

Now we use Authentic ([https://github.com/davidguttman/authentic](https://github.com/davidguttman/authentic)). In some ways it's better (e.g. get to control your own UI/UX flows), but it would have been nice to just have Mozilla run/host everything.

</comment><comment><USER61> Persona is a most promising idea because it will eventually lead to secure passwordless login everywhere. Keep the pedal to the metal guys!

<comment><USER62> But Persona _isn't_ passwordless, or?

<comment><USER63> Persona is passwordless. The idea is that you verify with your email provider who supports it. Your email provider may have a password, but there's no Persona-related password (unless you use Mozilla's Persona.org service because your email provider doesn't support Persona directly).

</comment></comment></comment><comment><USER64> Don't know why persona never caught on, it was probably the best developer/user logon experience I've ever used. When I created my last site, I was very excited about persona, until I realized nobody was developing it anymore, which made me decide against using it. I wish Mozilla would have completed persona before abandoning it.

</comment><comment><USER65> Sorry, where is it said they will stop development of Persona? The homepage and the service seem to be in full health, there's no warning anywhere for users of Persona.

Is there any official statement that Persona will shut down?

<comment><USER66> [http://identity.mozilla.com/](http://identity.mozilla.com/)

</comment></comment><comment><USER67> Persona sounds like what I've always dreamed of for authentication. Why is this not happening anywhere yet?

</comment><comment><USER68> The message I got from Persona was "hey we're developing this thing, it'll be part of Firefox." Sounded like a pretty good idea to me and the signal for it being ready so I could reasonably push for adoption. Then it got shut down for no apparent reason.

</comment><comment><USER69> My first experience with Persona was through my mobile phone provider, Ting. They still use Persona: [https://ting.com/account/login](https://ting.com/account/login). I loved it then, and I love it now.

</comment><comment><USER70> I haven't looked into Persona since they shut it down, but is it a protocol or a service? If it was actively developed again, would one be able to use Persona without integrating with any Mozilla service at all or would there always be a Mozilla layer involved?

<comment><USER63> The backend was called BrowserID, and it was supposed to integrate with your browser and be supported by email providers _not_ be some Mozilla service. It's only a service because they didn't get around to implementing the actual BrowserID design, so they run a service for now, and then they halted development before they even _tried_ to build the actual design!

</comment></comment><comment><USER42> I really liked Persona and put a bunch of work into extending it (adding support for things like selective attribute disclosure). One real design limitation was that it didn't support delegation (the original use case for OAuth).

</comment><comment><USER71> Just an idea but could they work with the wordpress guys to make it the default system for wordpress? They're both open source companies and apparently wordpress runs a large percentage of the web.

</comment><comment><USER72> I didn't even realize Persona was shut down. It was a good idea.

</comment><comment><USER73> AND TAKE POCKET AWAY!

</comment><comment><USER74> My only gripe with Persona is that it is not easy to use in mobile apps, if at all possible.

</comment><comment><USER75> Mitch Baker should be commended on her hard work turning Mozilla back into Netscape.

</comment><comment><USER76> You know what poverty is? Always starting over. Mozilla is getting good at that.

<comment><USER77> Firefox is ancient.

</comment></comment><comment><USER78> People who write open letters need to fall in a hole. They're so lame.</comment>


The Unscientific Asthmatic - <AUTHOR> https://github.com/stephenhu/written/blob/master/asthma.md <comment><AUTHOR> author here, hopefully some folks can comment on their own experiences and observations. i'm especially curious about those without Eczema, but with Asthma.</comment>


Climate protesters storm Garzweiler coal mine in Germany - <AUTHOR> https://www.bbc.co.uk/news/world-europe-48734321 <comment><USER2> One thing to note when reading such reports with quotes the German police, is that the bar for a police officer being "hurt" is ridiculously low in Germany. E.g. if an officer is grabbing your arm, and you try to yank it free, this constitutes "assaulting a police officer" and will go into that number. In past protests the police also reported officers being hurt without qualifying that they had been hurt by other officers employing tear gas against protesters.

Edit: to add at least one source, here's Spiegel Online reporting that the police counted dehydration and circulatory issues as "injured officers" (German unfortunately)

[https://www.google.com/amp/s/www.spiegel.de/panorama/justiz/...](https://www.google.com/amp/s/www.spiegel.de/panorama/justiz/g20-viel- weniger-verletzte-polizisten-als-angegeben-a-1157913-amp.html)

<comment><USER3> > One thing to note when reading such reports with quotes the German police, > is that the bar for a police officer being "hurt" is ridiculously low in > Germany.

I'm totally okay with it.

One thing to note, at least in Berlin where I live, there's huge contempt and disrespect towards police. Some criminals (calling themselves "protesters") are literally throwing rocks, cobblestones, bottles (or at times Molotov cocktails) at policemen. This is totally despicable and should never be accepted.

At the same time police is heavily underfunded and constrained in their means by ignorant (malevolent?) local government.

<comment><USER4> How do you make the jump from (or, further yet, justify) the use of ridiculous definitions of officer injury, to police funding and police constraint problems or occurrence of violent clashes? Adverse conditions invite malpractice, but doesn't make it justifiable.

Actually, on second read, you're not really justifying one with the other, you're just saying that you sympathize with the German police, which according to you has it bad, and you think that deceptive Police reports are thus tolerable.

To be clear, I'm not providing insight into the main discussion, just saying that your post doesn't read well.

<comment><USER5> > and you think that deceptive Police reports are thus tolerable.

I'll often cross check reporting with the actual police press releases and the deceptiveness tends to be in the reporting, not the press release. The press release might say something along the lines of "58 officers participated in a police action at the blah-blah protest, where 15 officers and 19 protestors were injured". Then the reporting will become "Blah-blah protestors injured 15 officers". Non sequitur.

</comment></comment></comment></comment><comment><USER6> Burning lignite is the most ridiculous thing you can do. It would literally be better for the climate to import coal from Australia and burn that. There is no point in delaying the end of lignite mining until 2038.

We need a massive buildout of wind and solar and we need it now. There are no technological problems left, we just need to spend the money. The 20k coal jobs in Germany would pale against the workforce needed for a rapid switch to renewables.

<comment><USER7> We need a massive buildout of nuclear and we need it thirty years ago. Wind and solar aren't nearly as good as nuclear.

<comment><USER8> Humanity have time and time again proven they can't handle the responsibilities that come with nuclear. An 'I wash my hands and walk away, or even better, make a profit of the cleanup when it all goes wrong' neo-liberal market economy that skirts all the dangers 'by design' is a fatal compounding factor.

<comment><USER7> What are those times? It has been massively more safe than almost any other form of energy generation.

Edit: Why the downvotes without a counterpoint?

<comment><USER9> You have to define what you mean by safe. It's not good for nuclear proponents that Fukushima and Chernobyl happened, after spending decades telling everyone how some like this could "never" happen. I've read quite a lot of pronuclear books and they are never very good at explaining risks. They basically say we have thought of everything and there is no risks, or talk about non existent tech. This is not good enough. Given their track record.

And I'm actually pronuclear.

<comment><USER10> And the radioactive waste that coal plants spew directly into the atmosphere during _normal operation_ somehow gets a free pass...

<comment><USER11> At the very least on HN, people are quick to point out the radioactive material released by coal plants - I do not remember a single relevant discussion where it wasn't.

Personally, I'm on board with getting rid of nuclear and fossil energy sources both, which appears technologically feasible to me (offshore windparks help with base load, flywheels can get you through the day and power-2-gas through the winter).

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Why would they storm a mine where poor people work in hazardous and exhausting conditions? Do they not know that the company owning the mine is headquartered in Essen, where the top-level managers responsible for this actually work? (The company, RWE AG, has a 14 billion euros market cap and is not even mentionned in the article, good reporting BBC!)

<comment><USER13> Because the only way to stop climate change is to stop extraction of fossil fuels. Once they're out of the ground they're destined for the atmosphere. I envision state actors doing the same thing eventually.

<comment><USER14> the point is that the decisions are being made somewhere else. RWE executives get to isolate themselves and continue to talk about _bonuses_ and _shareholder value_ , while themselves remaining entirely removed from the discussion. At the same time it is the poor people which have to be in the trenches and the effects will be felt by all (including plant and animal species we haven't even discovered yet).

Naming and shaming these crooks in public, and on social media is the future. If that doesn't gel then go after their families and children too. The stakes from damages due to climate and environmental crimes are simply too high.

<comment><USER15> Pretty easy to erode shareholder value for mining companies if they're unable to mine.

</comment></comment></comment></comment><comment><USER16> Fantastic.

Pity here in Australia we just voted in a ~corrupt government who have signed a deal to allow Adani to open a huge new coal mine that doesn't even benefit Australians economically, and at a huge cost to the environment.

<comment><USER17> Mining hasn't benefited Australia economically? what are they teaching over there?

<comment><USER18> Some mines require a lot of subsidies. These can be direct or indirect.

[https://www.australianmining.com.au/news/mining-subsidies- ov...](https://www.australianmining.com.au/news/mining-subsidies- over-4-5b-australia-institute/)

> The Productivity Commission figures from earlier this month showed the > mining industry got direct subsidies of $492 million last year.

> But senior economist at the left-leaning think tank Australia Institute Matt > Grudnoff said total subsidy is almost ten times that amount when tax > concessions given to mining companies are included.

> "The mining industry has the lowest rate of corporate tax because it has so > many tax concessions," he said.

<comment><USER19> But the bulk of those subsidies are the fuel credit rebate. On the one hand, it is technically a subsidy under the standard definitions of what a subsidy is. On the other hand, the tax was never intended to tax diesel because of some problem with diesel, it was literally intended to target (quoting from the Act [0]):

"(a) fuel used in private vehicles and for certain other private purposes; and (b) fuel used on-road in light vehicles for business purposes."

Ie, it is a tax on road users as a user-pays style of thing and the subsidy is an accounting trick to make it easy to implement.

If a solar company used a lot of fuel without using the public road system, they would be eligible for the subsidy too. It isn't conceptually mining specific.

[0] [http://www8.austlii.edu.au/cgi-bin/download.cgi/cgi- bin/down...](http://www8.austlii.edu.au/cgi-bin/download.cgi/cgi- bin/download.cgi/download/au/legis/cth/consol_act/fta2006103.txt)

</comment></comment></comment></comment><comment><USER20> What's the hack with the coal industry? _New_ renewable energy is now cheaper than _existing_ coal.

[https://www.forbes.com/sites/energyinnovation/2018/12/03/plu...](https://www.forbes.com/sites/energyinnovation/2018/12/03/plunging- prices-mean-building-new-renewable-energy-is-cheaper-than-running-existing- coal)

<comment><USER21> 24x7 sustained power output, lots of existing tech and expertise, ample supply of fuel, and inertia to change.

</comment></comment><comment><USER22> I would say burn it all down, but I guess in this case that isn't quite a good idea. We should be moving off of coal yesterday. The Energie Wende is a massive failure, especially with the removal of solar subsidies. I'm ashamed that this is my government supposedly representing my interests.

</comment><comment><USER23> Still can't believe Germany turned its back on nuclear to burn coal instead.

<comment><USER24> So, you haven't heard about Chernobyl nor Fukushima?!? Maybe stop reading hackernews and go to CNN and Wikipedia pal!

<comment><USER25> 1) don't build new reactors using 60-year old technology(even though that technology has proven safe after the major issue was rectified after Chernobyl)

2) don't build reactors in areas threatened by tsunamis and earthquakes. Germany is safe from both, so using Chernobyl and Fukushima to justify shutting down reactors in Germany, or even worse, stop construction of new ones, is borderline insane.

<comment><USER26> The problem is:

\- new reactors would still produce nuclear waste we don't have a storage solution for

\- no one can afford new reactors. Properly safe new reactors cost so much that they are not economically feasible.

<comment><USER25> >>\- new reactors would still produce nuclear waste we don't have a storage solution for

And this is the bit I just don't understand. The solution is almost obvious:

[https://en.wikipedia.org/wiki/Deep_borehole_disposal](https://en.wikipedia.org/wiki/Deep_borehole_disposal)

Dig a shaft 5km deep, put your waste at the bottom, fill it up. Nothing from that depth it coming out through any natural process for eons. I wonder why it's not actually done...

"[...] pair of proposed test boreholes in the United States were cancelled due to public opposition"

Oh. Of course.

</comment></comment></comment></comment></comment><comment><USER27> Was there had a good time

</comment><comment><USER28> I wonder if these are the same protesters who (successfully) clamored for the shutdown of all nuclear plants in Germany only a few years ago.

I wonder what they'll protest next, after they get what they want _this_ time.

</comment><comment><USER29> Judging from the comments, many HN readers are ok with illegal tactics in a cause they support. People in causes they do not support may think they have the right to employ similar tactics. There is not the politcal will to ban coal, or it would have been done.

<comment> shaki-dora Slavery was legal, interning Japanese-Americans during WW2 was legal, Apartheid was legal etc. Legality often lags morality.

The Civil Rights Movement also stepped on a few lawns it wasn't supposed to.

</comment></comment><comment><USER30> I have to be honest, I never had the occasion to see those huge machines before I saw them in online photos, not from that article, but on places like reddit.

Maybe the companies involved in this industry don't really like to allow journalists, those mines and machines are quite scary and bad PR.

Anyway I guess most people might be surprised to see those tiny protesters next to that huge thing.

Meanwhile, I hope greenpeace activists will be turned into ridicule.

<comment><USER31> In Germany those machines are basically pop stars. Forget the few thousand jobs that would be affected, forget energy independence, for most Germans, I think, shutting down those monstrous monuments of an easier time would secretly be their number one drawback of abandoning lignite. It's a love/hate thing.

<comment><USER32> I confess to scanning the top photo in TFA for Baggers! You can see them in the distance</comment></comment></comment>


Ordering chicken nuggets, impossible NFL scores, and optimal change - <AUTHOR> http://datagenetics.com/blog/august22015/index.html

<comment><AUTHOR> It's just been pointed out to me that in the US, McDonalds sells Chicken McNuggets(TM) in denominations: 6, 10, 20 nuggets, and not 6, 9, 20 (which is how they do in the UK, where I am from).

Even though I now live in the USA, it appears I've never been into McDonalds and had need to note the sizes these items are sold in. I will not comment further on this :)</comment>


Show HN: Learn and practice flashcards in a different way - <AUTHOR> https://oigovoz.com?invite=HN <comment><AUTHOR> quick practice explains the idea - listen to cards. there are strategies [https://oigovoz.com/strategies](https://oigovoz.com/strategies) and user can also configure favorite voices (speed and volume) I encourage people to sign up and give it a try.

<comment><USER2> Did you reply to me?

Quick practice doesn't explain anything, it just throws you into the flashcard sequence.

Looking at the strategies, is the differentiator of this app that it lets you hear words slowly and "per word"?

Is there a way to say the word before the sound speaks it? Hearing the word seems to defeat the purpose, shouldn't you be saying it first so that you can evaluate if you were right or wrong?

</comment></comment><comment><USER2> How is it different?</comment>


Can your landing page do this? (Convert) - <AUTHOR> http://unbounce.com/landing-page-examples/built-using-unbounce/beautiful-landing-page-design-examples/

<comment><USER2> Building a solid landing page seems so easy until you have tried one and failed to sell. The formula really isn't too difficult, but it does work if you get yourself out of the way: 1) outline a clear value proposition, 2) provide a call to action (+ a cost if there aren't multiple pricings), and 3) build trust. #1 and #2 should always be above the fold and the most visually prominent. Anything else on the page that doesn't build trust should be ruthlessly cut if you want to focus on pure conversion.

It's easy to forget that YAGNI also applies to landing pages. Don't waste your time giving secondary information. They can get to it later. If they don't convert, they ain't gonna need it.

<comment><USER3> I thought landing pages were super easy, until I messed up. When I put up the initial landing page for my latest startup ( <http://questcompanions.com/> \-- finally launching next week!), the 'Enlist' button said 'Start' instead. Due to the non-traditional input box and the text on the button, people would just click 'Start'. Due to a lack of error handling in the frontend code, the empty email would go up to my server, go out to Mailchimp, and they'd hand back an error. All the user would see is "Invalid or duplicate email", then they'd move away.

When I integrated Mixpanel, I saw why immediately and was able to fix it, but by that point I'd already wasted an easy $10-20 on Facebook ad clicks leading to the page. Tiny sum of money, but those were good clicks. Implementing error handling, better button text, and slightly different text on the input box caused the conversion rate to go way up, and the rate of people clicking the button without filling in an email dropped to nearly zero.

Long story short, measure everything and be very, very smart about your messaging.

<comment><USER4> I built my first web site/blog a couple of weeks ago, and I've been experimenting with advertising on Google, Bing, Facebook, etc, and I have to say it's been a really interesting experience.

Basically the most important thing I've learned is that I have to understand why my users are coming to my site, and from there tailor my site around that.

I have a very high bounce rate of around 75%, but most of that is due to smartphone users and the fact my site is pretty hard to use for them. Creating a simplified page is my #1 goal over the next couple of weeks.

Looking at logs, I also realized that my landing page was hard to use for a significant percentage of my new visitors. I could see from the logs that they were getting confused, trying it out a couple of times and bouncing. I was working on this last week, and tried a couple of GUI changes, but decided that having unintrusive error boxes would probably help better. Hopefully that will help those users having trouble.

But from the ones that stick around, I do have a few pretty regular users, and that leads to what I think is a kind of nice ad clickthru rate. I've paid a good chunk of all my costs in the first two weeks (of course, my costs are only around ~$30).

Thanks for the pointer to Mixpanel. I was looking for a better type of analytics than Google Analytics which doesn't offer me a great deal of information. The only hesitation I have is whether or not having all this javascript client-side tracking will cause users to question their privacy. I guess I'll cross that bridge when I get to it.

</comment></comment></comment><comment><USER5> Unbounce looks great- I've been sitting on the fence about these types of service for a while now.

What is HN's opinion on using a free version of a Unbounce (or other service)? (Coming from a student creating a start-up, no savings what so ever right now)

Does it distract from the purpose of the landing page heavily? Does it add credibility? My quick and unprofessional opinion is that I would rather have the paid version, but since I have to really value what little money I have, I'm unsure if paying for a landing page service is wise or not.

<comment><USER6> Actually it depends on for what purpose you intend to create that landing page. If it is for a B2B service, obviously it looks unprofessional. But for most of the other services, a short blurb in footer isn't too distracting.

</comment></comment><comment><USER7> I'm a huge believer in unbounce, for one simple reason. Once development barriers diminish all of this process will return once again to the control of marketers.

I think they see this and are pushing this as a tool for the masses of people who can't code, but love to sell, and want to do it better.

</comment><comment><USER8> Has anyone used Manpacks? I'd never heard of it until now, but I'm considering signing up.

<comment><USER9> I've used it. It's awesome.

I mean, there's not a whole lot more to it than what you see. You sign in, pick some clothes, and they ship it to you on a schedule. Saves me a trip to Costco every 6 months (or from feeling guilty about not going on that trip that often).

</comment></comment><comment><USER10> Great article, thanks! As we're discussing landing page effectiveness and I've just put together our landing page, I would love some constructive feedback:

<https://www.openrent.co.uk/home/index>

We're a week or two from launching, hence the slightly masked url. But any feedback before we put it in front of customers would be greatly appreciated.

I hope this is an appropriate place to ask!

<comment><USER11> I though that the blue stripes were buttons... Silly I know, but you did ask for feedback!

<comment><USER12> IMO the blue header bg is completely wrong - they do look like buttons, not only that they look like the current sites buttons. The whole impression is clean and technical; is this what you're after for selling people a place to call home (albeit rental).

It's personal taste but the text-align:center on that first heading screws with me too.

Also, on usability, when arriving at the site I'm thinking you'll not have anything in my area ... which is presumably the big problem with such sites, seeding them. So, perhaps you'd consider putting your strap line inside the header and having an optionally displayed "we have 234 rentals near you" or something; sniff IP and show it went it's over a threshold.

<comment><USER10> Thanks for the feedback.

The headers are meant to look highlighted, rather than like buttons, I really need to think about this. Personally, I thought they looked good, but if it's causing usability issues, then they need updating.

You're right, we have the classic chicken and egg problem, but we're focusing on landlords for now. Love the idea about pre-searching for users. Wouldn't want it to impact page load times though, so perhaps it could be a client side call once the page has loaded. The one issue is that people may not search for properties in their current location - but it's a starting point.

</comment></comment></comment></comment><comment><USER13> Maybe it's just me but thanks for linking some of those. One of them is a service I've been looking for. I think some of those sites just got some free advertising :p

</comment><comment><USER14> Awesome to see this discussion going on - and thanks to qrlawified for submitting the post to kick this off.

For anyone interested in trying out Unbounce, I wanna give you a coupon code (somewhat sheepishly as this isn't the usual forum). But if you do wanna check us out, use "hn503" to get 50% off for 3 months.

If you flame me I'll either kiss you or hug you... #JustSayin

</comment><comment><USER11> I can't believe that Crikey.com.au have forgotten to add their privacy statement. In Australia, that is a _huge_ no-no. Even a link to it would have been good - they can't just state that they won't share the information gathered.

<comment><USER15> Can you explain why its a big no-no? I'm new to Australia. Thanks.

<comment><USER11> Sure. Privacy is something that is covered via 10 National Privacy Principles. Principle 5 covers "Openness" [http://www.privacy.gov.au/materials/types/infosheets/view/65...](http://www.privacy.gov.au/materials/types/infosheets/view/6583#npp5)

Basically, it states "an organisation must set out in a document clearly expressed policies on its management of personal information. The organisation must make the document available to anyone who asks for it".

In general, the best way is for a link to the site's privacy guidelines. Crikey has one at <http://www.crikey.com.au/about/privacy/> \- they could easily have published a short link to it on the site shown in the article. I'd say this was an oversight on their part, but from my POV quite a big one!

<comment><USER16> If the document were printed on sheepskin and available to view in their office from 9am to 5pm, wouldn't that be making the document available to anyone who asks? Or is there specific legislation around a website having it published online and linked to from every page?

<comment><USER11> I don't think the privacy commissioner would take too kindly to this. That would be an accessibility issue. You'll notice though that on that page there isn't actually anywhere you can find the privacy policy.

I don't believe there's any legislation to force people into providing their privacy policy online. Though I would say the effort taken to get people to come into the office to view the privacy policy on the sheepskin would be prohibitively expensive. :-)

</comment></comment></comment></comment></comment><comment><USER17> Would also love some constructive feedback: picdazzler.com

Note: still waiting for the before/afters and copy to get here, disregard that please.

<comment><USER11> Can you move the .com closer to the PicDazzler text? I'd suggest putting the email address into a link - but an online form might be neat also. I'd also add a note very close to the email address that you won't use the email for evil purposes.

Or See some before and afters - you really need to change that text colour. It's almost black on black... sign up or sign in is out of alignment and bleeding over the rectangular box with curved corners. Seems to be an issue with the div with id=main and class=grid_12.

Just my 2c :-)

<comment><USER17> Thanks! I probably posted that prematurely, as those things are all on the list of "shit to fix".

</comment></comment></comment><comment><USER18> Great resource and like the pros and cons although with stats would've been better.

</comment><comment><USER19> very good collection and summary for landing page optimization. i hope another version of this had conversion rate comparison, though i am not sure how you could do this..</comment>


GreatFire is tracking Apple iOS applications for instances of censorship - <AUTHOR> https://applecensorship.com/ <comment><AUTHOR> More context: [https://mailchi.mp/greatfire/applecensorship](https://mailchi.mp/greatfire/applecensorship)

<comment><USER2> This text (or link) should be on the site's homepage.

<comment><USER3> Which site are you referring to? Apple's, Mailchimp, or something else?

<comment><USER4> I think they mean Applecensorship.com

<comment><USER2> Yes.

</comment></comment></comment></comment></comment><comment><USER5> Please note that while Apple itself may censor applications in regions, creators of the apps may choose to limit their distributions as well. For example: Bank of America's mobile banking app isn't available in Pakistan where I currently am, but this website wouldn't differentiate between that type of censorship or Apple's censorship.

But, personally, I still think this is a great idea!

<comment><USER6> I would hesitate to call that "censorship" at all. Some apps simply aren't relevant in a country because they're associated with a physical service which doesn't exist there. For example, a number of food delivery apps (like Uber Eats and Grubhub) don't operate in China, and as such have chosen to not make their app available there.

<comment><USER7> And nobody ever leaves the country. Or if they do, they're totally willing to go through the entire giant hassle of switching their account for a few days.

<comment><USER8> Then take that up with the individual app developer.

It has nothing to do with Apple or censorship.

<comment><USER7> I was objecting to the statement that some apps are not relevant in those countries.

</comment></comment></comment></comment></comment><comment><USER9> I'm not sure how this shows censorship. It just shows you if an app is available in China.

Lots of apps aren't available in China or outside of where the developer is based.

<comment><USER10> It's also a really, really, really hard line to draw. Lots of countries have laws and regulations that may require a company to withdraw apps from an app store. If you had a Wolfenstein game in your app store, you'd have to "censor" it in the German app store. China is especially censorious and authoritarian, but your only options are (a) don't do business at all in an especially censorious and authoritarian country, thereby censoring _all_ of the apps, or (b) censor the apps the government wants you to censor, which is what you already have to do in lots of other countries anyway.

<comment><USER11> In this case, it isn't Apple censorship. But even if Apple was the one to pull an app due to a country's local laws, we can't expect Apple to start refusing removal requests when it threatens the app store (or worse, Apple products) being banned in the entire country.

</comment></comment></comment><comment><USER12> Isn't this just "Apple complies with local laws in China (etc.) requiring them to remove VPN apps and hand over data belonging to political dissidents?"

Greatfire is right: Apple could indeed take a stand for freedom - if the shareholders demanded it and and were willing to shut down Apple's iPhone sales and manufacturing business, which is responsible for the bulk of Apple's income and profits.

Google famously left China, but Google is more of an advertising company than a hardware company.

<comment><USER13> Still I find it comical that people thinks Apple keeps the moral high ground. I personally find Apples position disgusting and super hypocritical. Sure, they are the white knight that keeps you safe from other monsters, only if you avert your gaze from China. At least Google so far sticked to its decision, and hopefully keeps it that way.

</comment></comment><comment><USER14> As many have noted, you can't tell from this site whether apple decided to remove an app from the China app store or the developer decided never offer it in that coutnry. Because of that, it's not useful for calling out censorship.

We do know, however, that Apple does certain certain apps and functionality _on device_ for China. Censorship of the News app is one such example: [https://www.larrysalibra.com/how-apple-censors-news-in- china](https://www.larrysalibra.com/how-apple-censors-news-in-china)

</comment><comment><USER15> I don't understand how to use the site, but here's another good resource: [https://en.wikipedia.org/wiki/Censorship_by_Apple](https://en.wikipedia.org/wiki/Censorship_by_Apple)

</comment><comment><USER16> This is not entirely accurate. It will also show apps missing in China that the author has decided not to publish in that region.

</comment><comment><USER17> Reminds me of Apple's censorship of US assassinations: [https://motherboard.vice.com/en_us/article/538kan/apple- just...](https://motherboard.vice.com/en_us/article/538kan/apple-just-banned- the-app-that-tracks-us-drone-strikes-again)

There's a reason why centrally curated platforms are dangerous, and why Free Software Principals reject them.

What's with the downvotes? More censorship?

<comment><USER18> That app shows up in the app store. What changed?

<comment><USER17> It mentions it in the article. Supporters keep putting it back up and Apple continuously takes it down (under pressure of the US gov).

For context, the app was created to track human rights abuses during the disclosure of the US's covert surveillance and assassination program in the Middle East. This was a scandal for the United States because it was disclosed that they were killing innocent people with knowledge and through reclassification, even killing children (internally using the terminology "fun sized terrorists").

The pressure to remove the app was brought to Apple during a sweep to control the scandal and public perception of the program.

(Given the public conversation has moves far past the scandal, and the Trump administration continues the indiscriminate assassinations, that censorship program does seem to have succeeded)

<comment><USER18> Just speculation, but I wonder if Apple kicks it out simply because it is controversial and very political, and they just don't want to deal with it.

It's also a fairly low-value proposition for a native app, in my opinion. It's really the kind of content worthy of a web page, that's about it. Not sure that contributes to Apple's vendetta against it, however.

<comment><USER17> If you read the reporting on the subject, you'll learn it is from government pressure.

I agree with you, and think its endemic of the app ecosystem.

</comment></comment></comment></comment></comment><comment><USER19> China commands such a massive market which makes it hard to rationalize neglecting it, purely from a revenue standpoint. Going to be interesting to see how Western companies respond to the continuing rise of authoritarian policies in China, and whether or not it influences their business practices outside of China.

</comment><comment><USER20> It's politics, but I choose to not have my app distributed in China due to bot hyperactivity ruining my metrics.

</comment><comment><USER21> Interesting I typed in Clash of Clans and found all of the Clash of Clans clone games like Clash of Kings, etc. Only the Chinese App store had Chinese letters in their name.

</comment><comment><USER22> I don't get the purpose of "VPN apps" as opposed to just signing up for a VPN service and setting it up in iOS settings.

<comment><USER23> That's silly. That's like wondering why people use awful streaming sites to watch movies and not download high quality torrents instead.

Ease of use, easy of discovery, learning curves, etc.

<comment><USER22> What's hard about going into settings and then

General -> VPN -> add configuration and entering

\- Server

\- remote ID

\- Username

\- Password

This is less setup than adding an email account.

<comment><USER24> Except an email account is something everyone has to use in the day to day, and getting to that point was a 15 year battle. Go down and work with the IT department sometime, it's incredible the blind spots you'll see. The calrity of your knowledge is far from universal

<comment><USER22> So who is the set of people who are both technically savvy enough to know they want a VPN but can't follow the set up instructions I listed above if they were given by a VPN provider?

<comment><USER25> People with enough technical knowledge to know that they need a VPN to evade something like the Great Firewall, but not with enough technical knowledge to set it up manually.

They may have heard of so-and-so app, install it, and boom, it works. That's very appealing, especially if it's a custom protocol that is supposedly harder to detect.

Or maybe their grandkids have set it up for them, and don't want it to be any harder than it needs to be. Yada yada.

It's not really hard to come up with answers like this. The two options aren't "complete expert" and "blithering idiot".

</comment></comment></comment></comment></comment></comment><comment><USER26> Isn't it Chinese censorship - as reflected by Apple App store in China vs USA?

<comment><USER27> No, the tool allows you to compare availability against a number of countries in addition to China.

</comment></comment><comment><USER28> Will Apple allow their trademark to be used in this way? Or does it fall under the "____ sucks" provision of free speech?

<comment><USER29> It falls under the "nominative use" defense to an assertion of trademark infringement. Free speech has nothing to do with it.

Trademarks are intended to provide consumers with the confidence that the products they're buying really come from the producer they claim to come from. As such, you're prohibited from assembling your own computer and branding it Apple; you've never been prohibited from referring to Apple.

<comment><USER30> It was my understanding that this doesn't cover using a trademark in a domain name. I could be wrong; my only experience of this is that "WordPress" is a trademark, and therefore it's generally accepted that any WordPress related product is not allowed to use the trademark in their domains.

<comment><USER31> I am not a lawyer, but this 6th Circuit case might be relevant: Taubman v. Webfeats.

"Even if [the] use is commercial, it must still lead to a likelihood of confusion to be violative of the Lanham Act. 15 U.S.C. § 1114(1). In Planned Parenthood, the defendant used the plaintiff's trade name as a domain name, without the qualifying moniker 'sucks,' or any other such addendum to indicate that the plaintiff was not the proprietor of the website. In contrast, 'taubmansucks.com' removes any confusion as to source. We find no possibility of confusion and no Lanham Act violation."

[https://caselaw.findlaw.com/us-6th- circuit/1213191.html](https://caselaw.findlaw.com/us-6th- circuit/1213191.html).

</comment></comment></comment></comment><comment><USER32> Great site.

Additionally, this doesn't show the endless number of apps that Apple censored from _all_ countries' iOS app stores because they contained or might contain images of human bodies.

It's not something the site can do, but it's important to remember that this is just the tip of the iceberg: at least in China they are required by law to block e.g. VPN apps; no such equivalent law requires them to ban apps that contain nipples in the United States; that censorship is entirely voluntary.

<comment><USER33> > ban apps that contain nipples in the United States; that censorship is > entirely voluntary

Is that true? Because that would cut out the Tumblr, Imgur, Reddit, Flickr, Twitter, etc. apps. And those are just the ones I can think of off the top of my head.

<comment><USER32> I urge you to look into why the Reddit NSFW search looks and works the way it does, and why Tumblr alienated their userbase this quarter. In both cases you will find the root cause to be Apple app store policies.

Steve Jobs once famously cited iOS as having "freedom from porn", and went on to say that people would care more about it being blocked "when you have kids".

For being a California peacemonger, he missed out on big swaths of being a hippie.

<comment><USER33> > Tumblr [...] root cause to be Apple app store policies

No, that was almost certainly because of SESTA/FOSTA and was underway _well before_ they had their child porn snafu that got them temporarily booted from the App Store.</comment></comment></comment></comment>


Believe you can change (2012) - <AUTHOR> http://www.aaronsw.com/weblog/dweck <comment><AUTHOR> And of course, RIP Aaron... beyond sad.</comment>