Mozilla Identity Blog

Sent some feelers out to devs I respect. Verdict is mostly negative on Persona. Seems like Mozilla is merely providing bare bones support for Persona these days, and has stopped funding it: http://identity.mozilla.com/ Further, and this is the real nail in the coffin for me, it seems like if you wish to change your email address or lose access to it, there's no way to migrate all accounts at once. It's up to the implementor to support that: https://developer.mozilla.org/en-US/Persona/The_implementor_s_guide/En… Fun note: Until recently, Email wasn't even required to sign up for GS. A Hacker News user pointed out that without this there's no way to let a user reset their password, so I made it required (though there's still no actual way to reset your password yet. Eeps!) https://news.ycombinator.com/item?id=8521505

If you're looking under the hood, the mechanic's blog at http://lloyd.io/how-browserid-works offers a great explanation. The Mozilla blog covered the OpenID comparison at http://identity.mozilla.com/post/7669886219/how-browserid-differs-from… but it doesn't embrace the level of geekery you're likely seeking.

They've already stated that you'll be able to put your site logo and name into the login box [1]. As far as the password, I thought it was pretty clear that the password they are asking for is your Persona password, but maybe that's because I had just signed up. The point is that you'll only ever need one password, so it'll be great to be able to have one strong password rather than tens of weaker ones. [1] http://identity.mozilla.com/post/32395255498/announcing-the-first-beta…

StavrosK has a hybrid auth system -- that's not a part of Persona (née BrowserID). Which is actually kind of cool -- because we use email addresses as identifiers, it's really easy to add Persona support alongside traditional auth mechanisms, and without giving up ownership of your users. If you want to see a more "pure" Persona implementation, our standard example site is at http://123done.org/ (and you can preview the "Persona" redesign at http://dev.123done.org/). As for as being as easy for first-time users as "Click here to log in with Google / Yahoo," well, we've got some tricks up our sleeves. Look for a blog post next month at http://identity.mozilla.com/ :)

Disclaimer: my opinion is entirely MY OWN OPINION and does not reflect Mozilla's opinion or anyone I have worked with in the past. I also acknowledge my lack of deep understanding/insight of any sort but just a tiny bit of what I think I know, so feel free to correct me. I agree with many of your points because they are in fact excellent arguments. Trust can mean various of things. But in this context, trusting Mozilla is merely trusting Mozilla based on its reputation. Mozilla does not log your password and does not sell you to an advertizing agency so your new shiny Fx Account is really to be used for Mozilla service. At least as far as we know at this point. Mozilla was named #1 most trusted organization [1] but that doesn't mean we should say Mozilla is more trustworthy than Google without considering the context in which the trust is placed in. The first thing I want to echo is expectation. We expect so and so to do such job and deliver such promises. We expect that when we first sign up the password I pass to Firefox Account and Google Account, my password is hashed and salted with strong hashing algorithm. We expect Mozilla engineers and Google engineers to be honest and professional, so they won't be use MD5 or SHA1 to keep our passwords. But are they? We have to put a bet on Mozilla. Almost all the Mozilla projects are open-source, meaning they exist somewhere on mozilla-central or on Github. But we can't verify that a server is actually running the code the…

Persona is still hosted, right? Because I plan on using it. Does this remain accurate?: http://identity.mozilla.com/post/78873831485/transitioning-persona-to-… HN link: https://news.ycombinator.com/item?id=7362613 (a mozilla employee posted this: https://news.ycombinator.com/item?id=7364465 ) I'm confused about this post: https://wiki.mozilla.org/Identity/Persona_AAR If the goal is to keep providing this service, how has it failed? What is the goal?

sadly doesn't seem like Mozilla Persona is a good go-forward project http://identity.mozilla.com/post/78873831485/transitioning-persona-to-…

Persona is no longer developed by Mozilla -- Persona team has been moved to other Mozilla projects: http://identity.mozilla.com/post/78873831485/transitioning-persona-to-…

Persona is also defunct: https://news.ycombinator.com/item?id=7364465 http://identity.mozilla.com/post/78873831485/transitioning-persona-to-…

For more information on Mozilla's announcement re: Persona in March, see http://identity.mozilla.com/post/78873831485/transitioning-persona-to-…

They have already "handed it off to the community" so they can focus on other things. It won't be getting more funding or effort from Mozilla. edit: I just reread and realised you said "reconsider" and not "consider". Implying you already knew this, sorry. Here is the blog post in case anyone missed it anyway: http://identity.mozilla.com/post/78873831485/transitioning-persona-to-… and on HN: https://news.ycombinator.com/item?id=7362613

There's an OpenID bridge [1] to make it easier for GMail users to sign in using Persona if they're currently logged into GMail/Yahoo! [2]. I haven't used it but the end goal of Persona is that 3rd party email providers can be their own Persona identity providers. We definitely need something like Persona but I share your concerns WRT friction. Chicken meets egg. [1] http://identity.mozilla.com/post/56526022621/what-is-an-identity-bridg… [2] http://identity.mozilla.com/post/57712756801/persona-makes-signing-in-…

Judging by [1], the latter. 1: http://identity.mozilla.com/post/56526022621/what-is-an-identity-bridg…

Sorry crawled up from under a stone here. Asked myself how is this different from OpenID, then I found this (fyi). http://identity.mozilla.com/post/7669886219/how-browserid-differs-from…

How it works under the hood: http://lloyd.io/how-browserid-works Comparison to OpenID: http://identity.mozilla.com/post/7669886219/how-browserid-differs-from…

Exactly right: we hate the NASCAR array of buttons that is publisher-centric, rather than user-centric. I wrote about this a few days ago on the Persona blog: http://identity.mozilla.com/post/45842909320/users-dont-like-social-lo…

http://identity.mozilla.com/post/7669886219/how-browserid-differs-from… While the goals are similar, the ways differ. With perosona, the focus is on emails as the identifier. In case of OpenID, the identity provider may or may not have used email id as identifier.

Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-differs-from… In short, three big differences: 1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them. 2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal for Mozilla and for me. 3. Browser integration: The APIs are currently implemented with a javascript shim, but the browser can step in (either via native support or an extension) to provide new, exciting types of authentication -- dongles, certificates, interpretive dance via a kinect, etc.

There's an hour long video discussing the measures taken to protect the user's privacy, given by Ben Adida, one of the developers. It's 12 months old, but I believe the protocol hasn't changed enough to make the information out of date. https://www.youtube.com/watch?v=QDSh3osE4GQ Also, see this blog post: http://identity.mozilla.com/post/7899984443/privacy-and-browserid

You're talking about a phishing attack and it's actually worse for OpenID http://identity.mozilla.com/post/7669886219/how-browserid-differs-from… Once Persona is integrated into browsers it will offer better security. BTW, the iframe is always in a pop-up for this exact reason. It's never an iframe within the context of the website that initiated the login.

Used to be: http://identity.mozilla.com/post/18038609895/introducing-mozilla-perso…

I believe that a native implementation has been on their plans from the start, but I haven't heard much about it lately. Here's some mockups: http://people.mozilla.com/%7Efaaborg/files/projects/firefoxAccount/ind… There's also some work on integrating existing e-mail providers, so you can get instant identities: http://identity.mozilla.com/post/17207734786/id-provider-support-now-l… This is probably the web-thing I'm most excited about today, even though the development is kinda slow. I really want to implement it as a sole identity provider on my websites some day. EDIT: I also began writing a Safari extension that would work like the mockup above, but gave up halfway since it was too convoluted and totally insecure... maybe I should try writing a SIMBL plugin or something like that.

That link is to a very high level, non-technical overview, which is not a good link for HN. Try these links, which go into much more detail, answering the "why bother" questions. https://developer.mozilla.org/en/BrowserID/Why_BrowserID http://identity.mozilla.com/post/7899984443/privacy-and-browserid http://lloyd.io/how-browserid-works Note that BrowserID was the old working name for the project.

Er... "they" have also published the full source code involved (at https://github.com/mozilla/browserid ) and a privacy policy at http://www.mozilla.org/en-US/persona/privacy-policy/ that you can compare to said source code as desired, if you're using Mozilla's identity provider. As far as the architecture of the overall thing, there are also http://identity.mozilla.com/post/7899984443/privacy-and-browserid and http://identity.mozilla.com/post/11145921163/browserid-design-for-priv… and a technical specification at https://github.com/mozilla/id-specs/blob/prod/browserid/index.md that describes the exact data flow involved. And if you read those, it should become pretty clear _why_ this is better for privacy than the FB or Google login systems. For one thing, the identity provider is never told that you're logging in.

Well Hammer-Lahav calls it "the biggest professional disappointment of my career" on his blog[1] so I guess he's aware of that aspect (more[2]). The Mozilla Foundation's Persona[3] looks to be further along in terms of code and in terms of other people using it[4], differences with OpenID are partially described here[5]. Regardless of quality I think someone flying solo is going to have a hard time getting ahead of Persona at this point. [1] http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/ [2] http://hueniverse.com/2012/07/on-leaving-oauth/ [3] http://identity.mozilla.com/post/32395255498/announcing-the-first-beta… [4] http://identity.mozilla.com/post/31008721633/application-and-platform-… [5] http://identity.mozilla.com/post/7669886219/how-browserid-differs-from…