7 ms·

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor <3), and I have implemented Persona on many sites. This is all

by Osmose 11y ago

Disclaimer: I work for Mozilla, I maintain django-browserid (and StravosK is a valued contributor <3), and I have implemented Persona on many sites. This is all just my own personal opinion. I was very bullish on Persona early on, but the fact of the matter is, we failed. And not just because (as I feel is being implied) some higher up suddenly came over and asked for an unreasonable amount of adoption for a revolutionary product. We failed for a thousand reasons. It should've been supported directly within the Firefox chrome ASAP. It had branding different than the site you logged in to and was in a popup[1]. It took the name of another Firefox feature that users already knew about. Because the team was experimenting fast, the code quality of the service was such that outside contribution to it (or even cross-team contribution internally) was hard to impossible. There was no (or very limited) metadata available for things like a shared avatar or display name. We had enough time to do these things, but we didn't. The team accomplished something really amazing, but it wasn't enough, and most importantly, putting more effort into what already existed was not going to work. This idea that Mozilla can just turn around and throw effort at Persona and make it win now is, IMO, wrong. Identity needs more experimentation, that much is certain. But harping bringing back Persona in particular is beating a dead horse. We need a successor or a new project. [1] Not only did this make Persona look incredibly sketchy without a lot of priming users, it had a major privacy issue of leaking your identity provider and relying party to Mozilla via a centralized iframe we host. A mailing list thread among the Persona devs and community failed to find a solution to this.

StavrosK 11y ago
Hey Michael! <3 Aw :( Do you think these problems can be solved with an extension or a different protocol? How close were you to a solution for this?
- Osmose 11y ago
  The only thing that has a chance of happening is some external party coming up with a different protocol or extending the existing one, and gaining traction as an identity provider. Then, like we did with Pocket and "Save for Later", it's not unreasonable to think that Firefox would accept a system add-on that is compatible with this protocol to ship an in-browser UI. "gaining traction as an identity provider" being the hard part, of course.
  - cpeterso 11y ago
    If it was built as a WebExtension, it could work in Firefox and Chrome. :)
scrollaway 11y ago
I agree with you on most of this. And yes, a "Persona 2.0" should really just take the Persona lessons and learn from them, avoid the mistakes. That's also why I mentioned in my other reply that I'd be willing to help a project that has a chance to succeed - and that means being lead by someone who has themselves learned all the lessons from Persona. Someone who was on the original dev team. But this also needs backing from Mozilla, or a corporation like mozilla (there aren't many). While a lot of devs, including Mozilla devs, agree that Persona needs a successor... there's no sign of any such backing.
- igravious 11y ago
  > (there aren't many) Because this is so important maybe it should be left to just one entity to run. Ideally a federated identity login thing should be backed by a plethora of orgs. Let's make a list? Redhat, Linux Foundation, Raspberry Pi, Ubuntu, Mozilla, LibreOffice, Eclipse, GNU, ... ?
  - scrollaway 11y ago
    I could see a joint effort, similar to what happened with Let's Encrypt. The players who benefit are different though so it's harder to get the same kind of pull.
mook 11y ago
To me, Persona never _shipped_. They still discourage self-hosting the identity verification code, so even on a happy path where the user somehow managed to get an email provider that natively supported Persona you still had to talk to Mozilla servers. That's not federated identity, it's centralized; it offers nothing above Facebook Connect. Would doing that alone have made Persona a success? Probably not. But as it is, it's not even in the running. (Context: I wrote my own IdP, so in theory I could have been on that happy path.)
quadrangle 11y ago
Well, yeah, but Persona/BrowserID didn't fail, YOU (Mozilla) failed. BrowerID was the right concept, and it was insanely stupid to create a different frontend branding, to not build the browser integration, to not explain anything well, and then to describe the project as a failure when it hadn't even been implemented at all on your side.
- manigandham 11y ago
  > Well, yeah, but Persona/BrowserID didn't fail, YOU (Mozilla) failed. Did you read the post? This is exactly what the OP said: > I was very bullish on Persona early on, but the fact of the matter is, we failed.
  - quadrangle 11y ago
    Yes, I wasn't posting to argue with the other poster, I was just writing to clarify and emphasize further the BrowserID aspect of things and other contexts.
lifeisstillgood 11y ago
So, perhaps a different question - Can Mozilla host / bless the mailing list / forum where these successors to persona are discussed, built with volunteers and tried out?
TazeTSchnitzel 11y ago
> It should've been supported directly within the Firefox chrome ASAP. That could have been fixed, and could still be fixed. > It had branding different than the site you logged in to and was in a popup[1]. That could have been fixed, and could still be fixed. > It took the name of another Firefox feature that users already knew about. That could have been fixed, and could still be fixed really, but it's pointless now. > Because the team was experimenting fast, the code quality of the service was such that outside contribution to it (or even cross-team contribution internally) was hard to impossible. That could have been fixed, and could still be fixed. > We had enough time to do these things, but we didn't. The team accomplished something really amazing, but it wasn't enough, and most importantly, putting more effort into what already existed was not going to work. This idea that Mozilla can just turn around and throw effort at Persona and make it win now is, IMO, wrong. Why wouldn't it make it work? Persona was only alive for 2 years. It saw slow adoption, in part due to usability issues. If you fix the usability issues and give it more time, why wouldn't it be more successful? The issues holding it back were not fundamental. In fact, the fundamental design of Persona was sound and worked very well. Now, yes, merely fixing things and making the project supported again won't make it more successful overnight. It may need rebranding, it may need a lot of promotion, strategic partnerships, etc. But to declare it completely dead and waste effort on recreating what you already have is silly and counterproductive. Persona already has many sites - and people! - using it. It already has some (limited) brand recognition. It already has a solid protocol and design, a working codebase, a hosted service that is usable. The hypothetical successor to Persona? It has none of this. A hypothetical new approach? It has none of this. Could that change? Sure, but you're still starting from zero, and you have to re-do everything. But why start again when what you had wasn't fundamentally broken? > We need a successor or a new project. Why? What could a successor or new project bring that Persona couldn't?
interdrift 11y ago
Many things are wrong in many projects. In my yard , if something breaks I fix it, I don't buy a new yard.
wcummings 11y ago
>it had a major privacy issue of leaking your identity provider and relying party to Mozilla via a centralized iframe we host. A mailing list thread among the Persona devs and community failed to find a solution to this. Can you elaborate on this?
- Osmose 11y ago
  Here's the thread: https://groups.google.com/forum/#!searchin/mozilla.dev.identity/iframe/mozilla.dev.identity/KE6TAA-lgk4/kAzM46NP4vsJ https://groups.google.com/forum/#!searchin/mozilla.dev.ident... Basically, Persona by design needs to transmit a keypair and a signed certificate between the identity provider and the relying party. Without in-browser integration, the way this was done was using localStorage on the login.persona.org domain, making Mozilla a trusted third party. This was deemed okay as a temporary measure until in-browser support for BrowserID became commonplace, replacing the trusted third party with the user-agent. Reading the thread again, my memory was a little off: possible solutions were proposed, but the conversation fell off before consensus could be reached, and no one had the time to drive any attempt to implement the change.
stan_rogers 11y ago
Frankly, the name was the worst of it It took some effort to kill the UI-theming Persona with fire (and there were very good reasons to do so); anything that even hinted at the possibility that you'd have to resurrect that in order to do something that looked useful wasn't going to fly unless there was a lot of forgetting time in between uses. Yer average user doesn't monitor tech news sites in order to determine whether or not a product of the same name from the same outfit is really something completely different.
zimbatm 11y ago
All these points don't seem unsolvable problems to me. The only failure was to abandon the project before it had it's chance out in the world.

by Osmose 11y ago

StavrosK 11y ago

Hey Michael! <3 Aw :( Do you think these problems can be solved with an extension or a different protocol? How close were you to a solution for this?

Osmose 11y ago
The only thing that has a chance of happening is some external party coming up with a different protocol or extending the existing one, and gaining traction as an identity provider. Then, like we did with Pocket and "Save for Later", it's not unreasonable to think that Firefox would accept a system add-on that is compatible with this protocol to ship an in-browser UI. "gaining traction as an identity provider" being the hard part, of course.
- cpeterso 11y ago
  If it was built as a WebExtension, it could work in Firefox and Chrome. :)

scrollaway 11y ago

I agree with you on most of this. And yes, a "Persona 2.0" should really just take the Persona lessons and learn from them, avoid the mistakes. That's also why I mentioned in my other reply that I'd be willing to help a project that has a chance to succeed - and that means being lead by someone who has themselves learned all the lessons from Persona. Someone who was on the original dev team. But this also needs backing from Mozilla, or a corporation like mozilla (there aren't many). While a lot of devs, including Mozilla devs, agree that Persona needs a successor... there's no sign of any such backing.

igravious 11y ago
> (there aren't many) Because this is so important maybe it should be left to just one entity to run. Ideally a federated identity login thing should be backed by a plethora of orgs. Let's make a list? Redhat, Linux Foundation, Raspberry Pi, Ubuntu, Mozilla, LibreOffice, Eclipse, GNU, ... ?
- scrollaway 11y ago
  I could see a joint effort, similar to what happened with Let's Encrypt. The players who benefit are different though so it's harder to get the same kind of pull.

mook 11y ago

To me, Persona never _shipped_. They still discourage self-hosting the identity verification code, so even on a happy path where the user somehow managed to get an email provider that natively supported Persona you still had to talk to Mozilla servers. That's not federated identity, it's centralized; it offers nothing above Facebook Connect. Would doing that alone have made Persona a success? Probably not. But as it is, it's not even in the running. (Context: I wrote my own IdP, so in theory I could have been on that happy path.)

quadrangle 11y ago

Well, yeah, but Persona/BrowserID didn't fail, YOU (Mozilla) failed. BrowerID was the right concept, and it was insanely stupid to create a different frontend branding, to not build the browser integration, to not explain anything well, and then to describe the project as a failure when it hadn't even been implemented at all on your side.

manigandham 11y ago
> Well, yeah, but Persona/BrowserID didn't fail, YOU (Mozilla) failed. Did you read the post? This is exactly what the OP said: > I was very bullish on Persona early on, but the fact of the matter is, we failed.
- quadrangle 11y ago
  Yes, I wasn't posting to argue with the other poster, I was just writing to clarify and emphasize further the BrowserID aspect of things and other contexts.

lifeisstillgood 11y ago

So, perhaps a different question - Can Mozilla host / bless the mailing list / forum where these successors to persona are discussed, built with volunteers and tried out?

TazeTSchnitzel 11y ago

> It should've been supported directly within the Firefox chrome ASAP. That could have been fixed, and could still be fixed. > It had branding different than the site you logged in to and was in a popup[1]. That could have been fixed, and could still be fixed. > It took the name of another Firefox feature that users already knew about. That could have been fixed, and could still be fixed really, but it's pointless now. > Because the team was experimenting fast, the code quality of the service was such that outside contribution to it (or even cross-team contribution internally) was hard to impossible. That could have been fixed, and could still be fixed. > We had enough time to do these things, but we didn't. The team accomplished something really amazing, but it wasn't enough, and most importantly, putting more effort into what already existed was not going to work. This idea that Mozilla can just turn around and throw effort at Persona and make it win now is, IMO, wrong. Why wouldn't it make it work? Persona was only alive for 2 years. It saw slow adoption, in part due to usability issues. If you fix the usability issues and give it more time, why wouldn't it be more successful? The issues holding it back were not fundamental. In fact, the fundamental design of Persona was sound and worked very well. Now, yes, merely fixing things and making the project supported again won't make it more successful overnight. It may need rebranding, it may need a lot of promotion, strategic partnerships, etc. But to declare it completely dead and waste effort on recreating what you already have is silly and counterproductive. Persona already has many sites - and people! - using it. It already has some (limited) brand recognition. It already has a solid protocol and design, a working codebase, a hosted service that is usable. The hypothetical successor to Persona? It has none of this. A hypothetical new approach? It has none of this. Could that change? Sure, but you're still starting from zero, and you have to re-do everything. But why start again when what you had wasn't fundamentally broken? > We need a successor or a new project. Why? What could a successor or new project bring that Persona couldn't?

interdrift 11y ago

Many things are wrong in many projects. In my yard , if something breaks I fix it, I don't buy a new yard.

wcummings 11y ago

>it had a major privacy issue of leaking your identity provider and relying party to Mozilla via a centralized iframe we host. A mailing list thread among the Persona devs and community failed to find a solution to this. Can you elaborate on this?

Osmose 11y ago
Here's the thread: https://groups.google.com/forum/#!searchin/mozilla.dev.identity/iframe/mozilla.dev.identity/KE6TAA-lgk4/kAzM46NP4vsJ https://groups.google.com/forum/#!searchin/mozilla.dev.ident... Basically, Persona by design needs to transmit a keypair and a signed certificate between the identity provider and the relying party. Without in-browser integration, the way this was done was using localStorage on the login.persona.org domain, making Mozilla a trusted third party. This was deemed okay as a temporary measure until in-browser support for BrowserID became commonplace, replacing the trusted third party with the user-agent. Reading the thread again, my memory was a little off: possible solutions were proposed, but the conversation fell off before consensus could be reached, and no one had the time to drive any attempt to implement the change.

stan_rogers 11y ago

Frankly, the name was the worst of it It took some effort to kill the UI-theming Persona with fire (and there were very good reasons to do so); anything that even hinted at the possibility that you'd have to resurrect that in order to do something that looked useful wasn't going to fly unless there was a lot of forgetting time in between uses. Yer average user doesn't monitor tech news sites in order to determine whether or not a product of the same name from the same outfit is really something completely different.

zimbatm 11y ago

All these points don't seem unsolvable problems to me. The only failure was to abandon the project before it had it's chance out in the world.