Here's the thread: https://groups.google.com/forum/#!searchin/mozilla.dev.identity/iframe/mozilla.dev.identity/KE6TAA-lgk4/kAzM46NP4vsJ https://groups.google.co

Here's the thread: https://groups.google.com/forum/#!searchin/mozilla.dev.identity/iframe/mozilla.dev.identity/KE6TAA-lgk4/kAzM46NP4vsJ https://groups.google.com/forum/#!searchin/mozilla.dev.ident... Basically, Persona by design needs to transmit a keypair and a signed certificate between the identity provider and the relying party. Without in-browser integration, the way this was done was using localStorage on the login.persona.org domain, making Mozilla a trusted third party. This was deemed okay as a temporary measure until in-browser support for BrowserID became commonplace, replacing the trusted third party with the user-agent. Reading the thread again, my memory was a little off: possible solutions were proposed, but the conversation fell off before consensus could be reached, and no one had the time to drive any attempt to implement the change.