4 ms·
╔════════════════════════════════════════╦═══════════════════════════════════════════╦══════════════════════════════════════════╦════════════════════════════╗
by Flimm 10y ago
╔════════════════════════════════════════╦═══════════════════════════════════════════╦══════════════════════════════════════════╦════════════════════════════╗
║ ║ Persona with browser and email server ║ persona.org shim ║ OpenID ║
║ ║ integration ║ ║ ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ User identifier ║ email address ║ email address ║ URI ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ Auth provider ║ Email server ║ persona.org ║ OpenID server ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ Passwordless ║ Just one password for your email server ║ One for the shim, and one for your email ║ One for your OpenID server ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ Provider sees where you log in ║ No ║ No ║ Yes ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ Provider must stay online at all times ║ No, auth tokens are cached ║ No, but persona.org must stay online ║ Yes ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ Requires Javascript ║ Yes ║ Yes ║ unknown ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ Fallback available ║ Yes, just use the email ║ Yes, just use the email ║ None ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ Ability to contact user ║ Yes, just use the email ║ Yes, just use the email ║ None ║
╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
║ Implemented ║ In no desktop browsers or email providers ║ Yes ║ Yes ║
╚════════════════════════════════════════╩═══════════════════════════════════════════╩══════════════════════════════════════════╩════════════════════════════╝
- anarcat 10y agothat's a great chart, but a few corrections about OpenID: Provider must stay online at all times: the OpenID provider needs to be online when you login to the consumer site, after that, you have a session with that site and the provider doesn't need to be online. Requires Javascript: there's a fallback in OpenID. Ability to contact owner: there are extensions to propagate attributes like email addresses that are commonly supported.
- cdcarter 10y agoI think the key point is that by design, OpenID Connect doesn't necessitate that the identity provider reveals the users email address to the service provider. The identity provider can choose to include that in the token (or the UserInfo endpoint) or they can hide it behind another OAuth scope and explicit permission. Whereas by design, Persona does mean the service provider has access to your email address. For consumer applications, this is probably fine, but it's a very different assumption than most access and authorization use.
- anarcat 10y agothat's a great chart, but a few corrections about OpenID: Provider must stay online at all times: the OpenID provider needs to be online when you login to the consumer site, after that, you have a session with that site and the provider doesn't need to be online. Requires Javascript: there's a fallback in OpenID. Ability to contact owner: there are extensions to propagate attributes like email addresses that are commonly supported.