5 ms·

There was a fantastic protocol that really could have replaced much of the problems that OAuth has, while providing its users more privacy: BrowserID, aka Mozi

There was a fantastic protocol that really could have replaced much of the problems that OAuth has, while providing its users more privacy: BrowserID, aka Mozilla Persona. Sadly, it got effectively gutted by the Mozilla Foundation due to lack of use, and even Mozilla has stopped using it most places in favor of Firefox Accounts.

deleted 11y ago
[deleted]
- hlieberman 11y ago
  Indeed, it does! I'm a little bit scared of it, though, to be honest. It's a giant of a protocol, and has a lot of moving parts. I'm worried that implementation is going to be so complicated, it'll end up as OAuth 3.0.
guelo 11y ago
Mozilla only really gave it like a year before they pulled the devs. Probably to work on Hello and Pocket or something worthless like that.
- scrollaway 11y ago
  Let's be fair to Mozilla. Pocket is a separate company, and Hello is definitely not worthless in the grand scheme of things... merely less useful.
  - cobweb 11y ago
    Off topic: Pocket turned up in my Firefox. I don't even know what it is, and why it's there. It weirdly replaced my Readability icon. (Goes off to read). Okay so it's ReadItLater. Which I assume is something like Readability. Or is it bookmarking or shared bookmarking? What is it and why is it in Firefox? Mozilla pared down their suite to a barebones browser. With the option of add-ons. Now it looks as if Firefox are adding services/features back in the browser. I think I'd prefer Mozilla work on a better bookmarking/history api. And hopefully given a good API, I could drop in a provider that I could set up in any browser.
stephen 11y ago
I really liked BrowserID. I don't understand why Google/Mozilla/Microsoft wouldn't all get behind it, because it doesn't seem worth fragmenting on...
- cobweb 11y ago
  From my limited knowledge of BrowserId, it feels slightly wrong to me to place my identity in the web browser. What happens if someone borrows my PC, or I have multiple identitiesL This is still a bit of a 'mare for me when swapping between web browsers. Perhaps you should be able to hook an identity into any running app, via an identity manager/authentication agent.
  - gnud 11y ago
    BrowserId didn't tie your identity to your browser. It tied your identity to your email address, and made it possible to have several identities to choose from. The selling point was the browser integration. This would be especially awesome on mobile.
    - cobweb 11y ago
      Well that sounds better. But perhaps a poor choice of name. VisitorId might have been more appropriate.
  - WorldMaker 11y ago
    BrowserID wasn't intended to place your identity in the web browser, it was intended to place your identity manager/authentication agent in the browser. Your identity under BrowserID is whatever email address you wish to use, and BrowserID as a protocol is about A) how to verify that the user controls that email address, then B) how to cache that verification in the browser so that the user can easily reuse that email identity across multiple pages/sites. The login flow for Persona/BrowserID is essentially "Which email would you like to use for this site?" and let you use the same email for just about all of them or keep multiple identities, as many identities as you have email addresses you care to use.
acabal 11y ago
I'm really sad Persona got abandoned so quickly. Mozilla made some strange decisions in how it marketed and supported it, too: "Persona" was already the name of their browser themeing engine (or was it the other way around?), I don't remember there being a Chrome or IE plugin for it, I don't think any of the Mozilla-branded sites (like addons.mozilla.org) ever used it, and after just a year it got unceremoniously dumped. Everyone I talked to said it was a great solution and they were really interested to see where it would go. Why did Mozilla make so many weird decisions on what could have been a revolutionary technology? Is there any way to breathe life back in to it? When it came out I personally considered implementing it for Scribophile , but decided not to because I didn't want to invest a lot of time in an unproven technology. If I had seen it active and lively a few years down the road, I would have been more than happy to bite the bullet. Maybe my attitude was a common one, and doomed Persona to a chicken-and-egg situation. Who knows.
- callahad 11y ago
  > I don't think any of the Mozilla-branded sites ever used it You're right that AMO never used Persona, but a ton of Mozilla's other sites used (and still use) it. MDN, Bugzilla, Etherpad, the Firefox Marketplace, most of our metrics dashboards, etc. It wasn't a complete sweep, but we did see pretty solid internal adoption. > after just a year it got unceremoniously dumped. Longer than that. I think Lloyd and Mike hashed out the first version of the protocol back in March 2011. The bulk of the team came together around March 2012. Most of us were moved off the project in around November 2013, so we had closer to two years as an official project. ...wow, it really felt longer than that. > I didn't want to invest a lot of time in an unproven technology. That was a big reason we didn't go further than we did. People loved the idea, but relatively few folks were willing to actually back up that belief with action. We also share some of the blame: We thought we had more time to experiment with the core protocol and product design, but with Mozilla Labs' somewhat sudden dissolution, we were unexpectedly asked to demonstrate traction and commercial adoption that simply wasn't there.
  - scrollaway 11y ago
    Dan, I know you are not to blame for this but I hope you can at least forward the sentiment. I was at MozFest last year, with one of the execs on stage talking about Mozilla's efforts to "free the web". He went on and on for 15 minutes about it and I swear, the only thing on my mind at the time was how Persona had been gutted. Today's web isn't "free" if a core part of it is behind Facebook and Twitter. > People loved the idea, but relatively few folks were willing to actually back up that belief with action. Either Mozilla is full of it when they say they fight for the free web, or they massively misunderstand how important it is to get rid of proprietary authentication. If this is Mozilla's stance, Mozilla's belief, then Mozilla is the one not backing it up with action. Edit: Followup thoughts: I cannot get behind the way Persona was dumped. Firefox had an atrocious market share for many years, but devs didn't dump it. Persona can't revolutionize the web by taking down Facebook and Twitter in 24 months, and it's not good enough? Grr, there were at least a dozen other ways to stop spending as much effort on it without outright killing it. > Maybe my attitude was a common one, and doomed Persona to a chicken-and-egg situation. Yuuuup: https://bazqux.uservoice.com/forums/190752-general/suggestions/4832985-allow-authentication-via-mozilla-persona https://bazqux.uservoice.com/forums/190752-general/suggestio...
callahad 11y ago
Please take what we learned with Persona and build upon it, much like we built upon lessons learned from OpenID and OAuth. The Web needs this. As long as we keep trying, one day, someone will get it right.
- mlinksva 11y ago
  Is there a lessons learned / recommendations for the next attempt writeup?
  - callahad 11y ago
    https://wiki.mozilla.org/Identity/Persona_AAR https://wiki.mozilla.org/Identity/Persona_AAR is a pretty good place to start.
    - aidenn0 11y ago
      How do you make the persona brand invisible, while still giving users some visible feedback that they aren't sending their global password to random site x?
      - callahad 11y ago
        Persona didn't have the notion of a global password -- the ideal flow had you authenticating with your email provider, on their domain, which was often completely transparent in cases where you were already signed in to that provider. Try logging into 123done.org with whatever you want @mockmyid.com to get a sense of what that would ideally look like. My talk from PyCon 2013 goes into a little detail about how the protocol works: https://www.youtube.com/watch?v=nJff23UdNAI https://www.youtube.com/watch?v=nJff23UdNAI
        illumen 11y ago
        With most email accounts being provided by gmail, outlook, and yahoo, I don't see auth via email domain ever happening.
agumonkey 11y ago
The weirdest part is that everytime I read about Persona, everybody praises it, and .. yet nothing. Are we masochists ?
- azernik 11y ago
  The problem is that the first-mover is going to have to be the identity providers: Facebook, Google, maybe GitHub or LinkedIn for specific markets. Users won't trust some piddly little startup with their authentication. And without them, no developer would use it as their sole login (who'll use your service then?) and no users will set up accounts (who's going to do that for 0 services?)
  - agumonkey 11y ago
    I expected that the amount of developers wishing for persona would hint a large shop to bootstrap the network effect.. alas.
    - chii 11y ago
      The problem is that the existing identity providers don't stand to gain much if they switched, but stand to lose their control. Lose, lose for them, thus they didn't switch.
  - kpcyrd 11y ago
    Persona works by proofing you "are" that email. Your email provider needs to adopt this. If you run your own mail server you can do it yourself, if you don't, you can register with mozilla as a fallback.
    - azernik 11y ago
      For most people that means either Google (gmail) or some other party that will run email just for this purpose (for example, Facebook creates an email address for each profile already). The percentage of the public able or willing to run an email server is tiny. That is not a solution for any market big enough for anyone to care about.
Flimm 11y ago
Mozilla in the early days demoed a shiny proof of concept of how good the user experience could be with native support in the browser. [1] They never shipped this, so there was no carrot for websites to implement BrowserID/Persona, and websites struggled with the bad UX of the fallback. I don't know why they seem surprised that websites didn't take the plunge before Firefox did. [1] http://www.extremetech.com/wp-content/uploads/2011/07/firefox-account-manager.jpg http://www.extremetech.com/wp-content/uploads/2011/07/firefo...
NicoJuicy 11y ago
I once posted an article about Hawk ( http://alexbilbie.com/2012/11/hawk-a-new-http-authentication-scheme/ http://alexbilbie.com/2012/11/hawk-a-new-http-authentication... ) which is/was used by Mozilla identity API
jt2190 11y ago
For those who are interested, Eran Hammer released an OAuth2 replacement in September: "Iron is a simple way to take a JavaScript object and turn it into a verifiable encoded blob. Hawk is a client-server authentication protocol providing a rich set of features for a wide range of security needs. Oz combines Iron and Hawk into an authorization solution. Together these three modules provide a comprehensive and powerful solution." Read more here: http://hueniverse.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an-oauth-replacement/ http://hueniverse.com/2015/09/19/auth-to-see-the-wizard-or-i...
muyuu 11y ago
Persona is still hosted, right? Because I plan on using it. Does this remain accurate?: http://identity.mozilla.com/post/78873831485/transitioning-persona-to-community-ownership http://identity.mozilla.com/post/78873831485/transitioning-p... HN link: https://news.ycombinator.com/item?id=7362613 https://news.ycombinator.com/item?id=7362613 (a mozilla employee posted this: https://news.ycombinator.com/item?id=7364465 https://news.ycombinator.com/item?id=7364465 ) I'm confused about this post: https://wiki.mozilla.org/Identity/Persona_AAR https://wiki.mozilla.org/Identity/Persona_AAR If the goal is to keep providing this service, how has it failed? What is the goal?
zeristor 11y ago
I've learnt a lot from this thread, I'd not heard of Mozilla Persona before. Could it be The One Ring to rule them all? Charles Stross has his Rule34, I propose Rule 42 is that if something exists there must be a YouTube video of it. This one of a Dan Callahan presentation from a few years back https://www.youtube.com/watch?v=nJff23UdNAI https://www.youtube.com/watch?v=nJff23UdNAI With Rule38 being a blend of the two.

deleted 11y ago

[deleted]

hlieberman 11y ago
Indeed, it does! I'm a little bit scared of it, though, to be honest. It's a giant of a protocol, and has a lot of moving parts. I'm worried that implementation is going to be so complicated, it'll end up as OAuth 3.0.

guelo 11y ago

Mozilla only really gave it like a year before they pulled the devs. Probably to work on Hello and Pocket or something worthless like that.

scrollaway 11y ago
Let's be fair to Mozilla. Pocket is a separate company, and Hello is definitely not worthless in the grand scheme of things... merely less useful.
- cobweb 11y ago
  Off topic: Pocket turned up in my Firefox. I don't even know what it is, and why it's there. It weirdly replaced my Readability icon. (Goes off to read). Okay so it's ReadItLater. Which I assume is something like Readability. Or is it bookmarking or shared bookmarking? What is it and why is it in Firefox? Mozilla pared down their suite to a barebones browser. With the option of add-ons. Now it looks as if Firefox are adding services/features back in the browser. I think I'd prefer Mozilla work on a better bookmarking/history api. And hopefully given a good API, I could drop in a provider that I could set up in any browser.

stephen 11y ago

I really liked BrowserID. I don't understand why Google/Mozilla/Microsoft wouldn't all get behind it, because it doesn't seem worth fragmenting on...

cobweb 11y ago
From my limited knowledge of BrowserId, it feels slightly wrong to me to place my identity in the web browser. What happens if someone borrows my PC, or I have multiple identitiesL This is still a bit of a 'mare for me when swapping between web browsers. Perhaps you should be able to hook an identity into any running app, via an identity manager/authentication agent.
- gnud 11y ago
  BrowserId didn't tie your identity to your browser. It tied your identity to your email address, and made it possible to have several identities to choose from. The selling point was the browser integration. This would be especially awesome on mobile.
  - cobweb 11y ago
    Well that sounds better. But perhaps a poor choice of name. VisitorId might have been more appropriate.
- WorldMaker 11y ago
  BrowserID wasn't intended to place your identity in the web browser, it was intended to place your identity manager/authentication agent in the browser. Your identity under BrowserID is whatever email address you wish to use, and BrowserID as a protocol is about A) how to verify that the user controls that email address, then B) how to cache that verification in the browser so that the user can easily reuse that email identity across multiple pages/sites. The login flow for Persona/BrowserID is essentially "Which email would you like to use for this site?" and let you use the same email for just about all of them or keep multiple identities, as many identities as you have email addresses you care to use.

acabal 11y ago

I'm really sad Persona got abandoned so quickly. Mozilla made some strange decisions in how it marketed and supported it, too: "Persona" was already the name of their browser themeing engine (or was it the other way around?), I don't remember there being a Chrome or IE plugin for it, I don't think any of the Mozilla-branded sites (like addons.mozilla.org) ever used it, and after just a year it got unceremoniously dumped. Everyone I talked to said it was a great solution and they were really interested to see where it would go. Why did Mozilla make so many weird decisions on what could have been a revolutionary technology? Is there any way to breathe life back in to it? When it came out I personally considered implementing it for Scribophile , but decided not to because I didn't want to invest a lot of time in an unproven technology. If I had seen it active and lively a few years down the road, I would have been more than happy to bite the bullet. Maybe my attitude was a common one, and doomed Persona to a chicken-and-egg situation. Who knows.

callahad 11y ago
> I don't think any of the Mozilla-branded sites ever used it You're right that AMO never used Persona, but a ton of Mozilla's other sites used (and still use) it. MDN, Bugzilla, Etherpad, the Firefox Marketplace, most of our metrics dashboards, etc. It wasn't a complete sweep, but we did see pretty solid internal adoption. > after just a year it got unceremoniously dumped. Longer than that. I think Lloyd and Mike hashed out the first version of the protocol back in March 2011. The bulk of the team came together around March 2012. Most of us were moved off the project in around November 2013, so we had closer to two years as an official project. ...wow, it really felt longer than that. > I didn't want to invest a lot of time in an unproven technology. That was a big reason we didn't go further than we did. People loved the idea, but relatively few folks were willing to actually back up that belief with action. We also share some of the blame: We thought we had more time to experiment with the core protocol and product design, but with Mozilla Labs' somewhat sudden dissolution, we were unexpectedly asked to demonstrate traction and commercial adoption that simply wasn't there.
- scrollaway 11y ago
  Dan, I know you are not to blame for this but I hope you can at least forward the sentiment. I was at MozFest last year, with one of the execs on stage talking about Mozilla's efforts to "free the web". He went on and on for 15 minutes about it and I swear, the only thing on my mind at the time was how Persona had been gutted. Today's web isn't "free" if a core part of it is behind Facebook and Twitter. > People loved the idea, but relatively few folks were willing to actually back up that belief with action. Either Mozilla is full of it when they say they fight for the free web, or they massively misunderstand how important it is to get rid of proprietary authentication. If this is Mozilla's stance, Mozilla's belief, then Mozilla is the one not backing it up with action. Edit: Followup thoughts: I cannot get behind the way Persona was dumped. Firefox had an atrocious market share for many years, but devs didn't dump it. Persona can't revolutionize the web by taking down Facebook and Twitter in 24 months, and it's not good enough? Grr, there were at least a dozen other ways to stop spending as much effort on it without outright killing it. > Maybe my attitude was a common one, and doomed Persona to a chicken-and-egg situation. Yuuuup: https://bazqux.uservoice.com/forums/190752-general/suggestions/4832985-allow-authentication-via-mozilla-persona https://bazqux.uservoice.com/forums/190752-general/suggestio...

callahad 11y ago

Please take what we learned with Persona and build upon it, much like we built upon lessons learned from OpenID and OAuth. The Web needs this. As long as we keep trying, one day, someone will get it right.

mlinksva 11y ago
Is there a lessons learned / recommendations for the next attempt writeup?
- callahad 11y ago
  https://wiki.mozilla.org/Identity/Persona_AAR https://wiki.mozilla.org/Identity/Persona_AAR is a pretty good place to start.
  - aidenn0 11y ago
    How do you make the persona brand invisible, while still giving users some visible feedback that they aren't sending their global password to random site x?
    - callahad 11y ago
      Persona didn't have the notion of a global password -- the ideal flow had you authenticating with your email provider, on their domain, which was often completely transparent in cases where you were already signed in to that provider. Try logging into 123done.org with whatever you want @mockmyid.com to get a sense of what that would ideally look like. My talk from PyCon 2013 goes into a little detail about how the protocol works: https://www.youtube.com/watch?v=nJff23UdNAI https://www.youtube.com/watch?v=nJff23UdNAI
      - illumen 11y ago
        With most email accounts being provided by gmail, outlook, and yahoo, I don't see auth via email domain ever happening.

agumonkey 11y ago

The weirdest part is that everytime I read about Persona, everybody praises it, and .. yet nothing. Are we masochists ?

azernik 11y ago
The problem is that the first-mover is going to have to be the identity providers: Facebook, Google, maybe GitHub or LinkedIn for specific markets. Users won't trust some piddly little startup with their authentication. And without them, no developer would use it as their sole login (who'll use your service then?) and no users will set up accounts (who's going to do that for 0 services?)
- agumonkey 11y ago
  I expected that the amount of developers wishing for persona would hint a large shop to bootstrap the network effect.. alas.
  - chii 11y ago
    The problem is that the existing identity providers don't stand to gain much if they switched, but stand to lose their control. Lose, lose for them, thus they didn't switch.
- kpcyrd 11y ago
  Persona works by proofing you "are" that email. Your email provider needs to adopt this. If you run your own mail server you can do it yourself, if you don't, you can register with mozilla as a fallback.
  - azernik 11y ago
    For most people that means either Google (gmail) or some other party that will run email just for this purpose (for example, Facebook creates an email address for each profile already). The percentage of the public able or willing to run an email server is tiny. That is not a solution for any market big enough for anyone to care about.

Flimm 11y ago

Mozilla in the early days demoed a shiny proof of concept of how good the user experience could be with native support in the browser. [1] They never shipped this, so there was no carrot for websites to implement BrowserID/Persona, and websites struggled with the bad UX of the fallback. I don't know why they seem surprised that websites didn't take the plunge before Firefox did. [1] http://www.extremetech.com/wp-content/uploads/2011/07/firefox-account-manager.jpg http://www.extremetech.com/wp-content/uploads/2011/07/firefo...

NicoJuicy 11y ago

I once posted an article about Hawk ( http://alexbilbie.com/2012/11/hawk-a-new-http-authentication-scheme/ http://alexbilbie.com/2012/11/hawk-a-new-http-authentication... ) which is/was used by Mozilla identity API

jt2190 11y ago

For those who are interested, Eran Hammer released an OAuth2 replacement in September: "Iron is a simple way to take a JavaScript object and turn it into a verifiable encoded blob. Hawk is a client-server authentication protocol providing a rich set of features for a wide range of security needs. Oz combines Iron and Hawk into an authorization solution. Together these three modules provide a comprehensive and powerful solution." Read more here: http://hueniverse.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an-oauth-replacement/ http://hueniverse.com/2015/09/19/auth-to-see-the-wizard-or-i...

muyuu 11y ago

Persona is still hosted, right? Because I plan on using it. Does this remain accurate?: http://identity.mozilla.com/post/78873831485/transitioning-persona-to-community-ownership http://identity.mozilla.com/post/78873831485/transitioning-p... HN link: https://news.ycombinator.com/item?id=7362613 https://news.ycombinator.com/item?id=7362613 (a mozilla employee posted this: https://news.ycombinator.com/item?id=7364465 https://news.ycombinator.com/item?id=7364465 ) I'm confused about this post: https://wiki.mozilla.org/Identity/Persona_AAR https://wiki.mozilla.org/Identity/Persona_AAR If the goal is to keep providing this service, how has it failed? What is the goal?

zeristor 11y ago

I've learnt a lot from this thread, I'd not heard of Mozilla Persona before. Could it be The One Ring to rule them all? Charles Stross has his Rule34, I propose Rule 42 is that if something exists there must be a YouTube video of it. This one of a Dan Callahan presentation from a few years back https://www.youtube.com/watch?v=nJff23UdNAI https://www.youtube.com/watch?v=nJff23UdNAI With Rule38 being a blend of the two.