Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It doesn't work with google apps, unfortunately.

Which is completely logical when I think about it since persona would not use the mx record to find the identity provider.



Actually, why not?

Looking for that "aspmx.l.google.com" entry in the MX record would let them know, with a high degree of certainty, that Google is the login authority for that particular email address.

Is there something I'm missing?


Persona harps on 'your email address is your id' part, but it's just a way to get an identifier @ a domain (so your login id doesn't actually have to be a real email address). At this point, persona (or the service implementing persona, more precisely) will ask the domain to authenticate the identifier.

Using the mx record would be bad, because, if you are doing it yourself, then your email server would have to also have a persona authenticating server, it would be hard to use your own persona authenticating server and have a third party take care of email, etc.


There's the /.well-known/browserid [1] file that can be used to delegate a domain to another identity provider.

The main thing is that while Persona talks about email verification, the protocol doesn't require that email handling exists. Just that a server vouches for the existence of a user@host, so using MX records wouldn't be 'correct' even if it would be a useful heuristic for google apps domains.

There has been talk of using SRV records, but it looks like the .well-known/browserid file will be the recommended way to do things.

[1] https://developer.mozilla.org/en-US/docs/Mozilla/Persona/.we...


As callahad said, there are some issues and it isn't a core priority for the team.

That said... here is one of the building blocks https://github.com/mozilla/browserid/issues/2932

Get involved and implement this as a NodeJS module.


We're super interested in bridging to Google Apps, but it has some quirks that gmail.com itself doesn't, so it's on ice for the moment...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: