3 ms·

I tried Persona back then when it was new, and found it pretty confusing (as a user). Still, it feels like a lost opportunity that it is shutting down. Can som

I tried Persona back then when it was new, and found it pretty confusing (as a user). Still, it feels like a lost opportunity that it is shutting down. Can someone tell, in a nutshell, what the difference was between OpenID/OAuth (I mean whatever the heck it is that allows me to "log in using my Google/Facebook/GitHub account". I always mix up those two.)? Is it just that you use your e.g. Gmail or other third party email address, but then the authentication is not done by your email account provider, but by Mozilla?

Flimm 10y ago
╔════════════════════════════════════════╦═══════════════════════════════════════════╦══════════════════════════════════════════╦════════════════════════════╗ ║ ║ Persona with browser and email server ║ persona.org shim ║ OpenID ║ ║ ║ integration ║ ║ ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ User identifier ║ email address ║ email address ║ URI ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Auth provider ║ Email server ║ persona.org ║ OpenID server ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Passwordless ║ Just one password for your email server ║ One for the shim, and one for your email ║ One for your OpenID server ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Provider sees where you log in ║ No ║ No ║ Yes ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Provider must stay online at all times ║ No, auth tokens are cached ║ No, but persona.org must stay online ║ Yes ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Requires Javascript ║ Yes ║ Yes ║ unknown ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Fallback available ║ Yes, just use the email ║ Yes, just use the email ║ None ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Ability to contact user ║ Yes, just use the email ║ Yes, just use the email ║ None ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Implemented ║ In no desktop browsers or email providers ║ Yes ║ Yes ║ ╚════════════════════════════════════════╩═══════════════════════════════════════════╩══════════════════════════════════════════╩════════════════════════════╝
- anarcat 10y ago
  that's a great chart, but a few corrections about OpenID: Provider must stay online at all times: the OpenID provider needs to be online when you login to the consumer site, after that, you have a session with that site and the provider doesn't need to be online. Requires Javascript: there's a fallback in OpenID. Ability to contact owner: there are extensions to propagate attributes like email addresses that are commonly supported.
  - cdcarter 10y ago
    I think the key point is that by design, OpenID Connect doesn't necessitate that the identity provider reveals the users email address to the service provider. The identity provider can choose to include that in the token (or the UserInfo endpoint) or they can hide it behind another OAuth scope and explicit permission. Whereas by design, Persona does mean the service provider has access to your email address. For consumer applications, this is probably fine, but it's a very different assumption than most access and authorization use.
- anarcat 10y ago
  that's a great chart, but a few corrections about OpenID: Provider must stay online at all times: the OpenID provider needs to be online when you login to the consumer site, after that, you have a session with that site and the provider doesn't need to be online. Requires Javascript: there's a fallback in OpenID. Ability to contact owner: there are extensions to propagate attributes like email addresses that are commonly supported.
askvictor 10y ago
I understand ( it's been a while since I looked at it) that with persona, your identity is stored and handled by your browser, rather than an external service. I could have miss remembered, though.

Flimm 10y ago

╔════════════════════════════════════════╦═══════════════════════════════════════════╦══════════════════════════════════════════╦════════════════════════════╗ ║ ║ Persona with browser and email server ║ persona.org shim ║ OpenID ║ ║ ║ integration ║ ║ ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ User identifier ║ email address ║ email address ║ URI ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Auth provider ║ Email server ║ persona.org ║ OpenID server ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Passwordless ║ Just one password for your email server ║ One for the shim, and one for your email ║ One for your OpenID server ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Provider sees where you log in ║ No ║ No ║ Yes ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Provider must stay online at all times ║ No, auth tokens are cached ║ No, but persona.org must stay online ║ Yes ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Requires Javascript ║ Yes ║ Yes ║ unknown ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Fallback available ║ Yes, just use the email ║ Yes, just use the email ║ None ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Ability to contact user ║ Yes, just use the email ║ Yes, just use the email ║ None ║ ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣ ║ Implemented ║ In no desktop browsers or email providers ║ Yes ║ Yes ║ ╚════════════════════════════════════════╩═══════════════════════════════════════════╩══════════════════════════════════════════╩════════════════════════════╝

anarcat 10y ago
that's a great chart, but a few corrections about OpenID: Provider must stay online at all times: the OpenID provider needs to be online when you login to the consumer site, after that, you have a session with that site and the provider doesn't need to be online. Requires Javascript: there's a fallback in OpenID. Ability to contact owner: there are extensions to propagate attributes like email addresses that are commonly supported.
- cdcarter 10y ago
  I think the key point is that by design, OpenID Connect doesn't necessitate that the identity provider reveals the users email address to the service provider. The identity provider can choose to include that in the token (or the UserInfo endpoint) or they can hide it behind another OAuth scope and explicit permission. Whereas by design, Persona does mean the service provider has access to your email address. For consumer applications, this is probably fine, but it's a very different assumption than most access and authorization use.
anarcat 10y ago
that's a great chart, but a few corrections about OpenID: Provider must stay online at all times: the OpenID provider needs to be online when you login to the consumer site, after that, you have a session with that site and the provider doesn't need to be online. Requires Javascript: there's a fallback in OpenID. Ability to contact owner: there are extensions to propagate attributes like email addresses that are commonly supported.

askvictor 10y ago

I understand ( it's been a while since I looked at it) that with persona, your identity is stored and handled by your browser, rather than an external service. I could have miss remembered, though.