5 ms·

Browsers should have taken that space long ago. Mozilla tried with Persona, but inexplicably it was abandoned. We could have granular control of our real and ps

Browsers should have taken that space long ago. Mozilla tried with Persona, but inexplicably it was abandoned. We could have granular control of our real and pseudo identities.

glenstein 9y ago
Persona is exactly where my mind went with this as well. While Yahoo was flailing, trying to find some new vision, one of the few good things they did was partner with a company that really has a vision in Mozilla. Yahoo could have moved to align the significant portion of the web under their control into compatibility with Mozilla's various efforts, such as Persona. To me that's going to go down in internet history as one of the ultimate what-ifs. I feel like it was a missed opportunity for both companies.
- nathanaldensr 9y ago
  We don't need companies controlling the internet, and we certainly don't want them controlling our identity systems. The current status quo is already bad enough. Where is the implementation that allows me to own my identity? Why are my user records locked away in some (many) corporation's database?
  - kbenson 9y ago
    You're right that we don't need companies Co trolling g the internet, but it sure would have been nice to have a good login system backed by a company with the intentions and motivations of Mozilla (a non profit). Businesses aren't going to trade their content out of the goodness of their heart, they want something in exchange. I would much rather trade ad views through Mozilla using a list of my interests that I control than to allow excessive tracking and profile building by some untrusted third party. What we apparently have now is login collectives starting up, but who's to say how good or bad the practices are for each, or whether they have the ability to adequately secure their system.
  - zerostar07 9y ago
    it could be based on some other identity provider perhaps an anonymous one, even trustless. persona was flexible with regards to authenticators. the point is, if the browser had control of the SSO, then the user could control it, not facebook or google or twitter.
ryanwaggoner 9y ago
I'm still trying to understand the cryptocurrency space and its implications, but isn't digital identity a perfect use case for the blockchain? Decentralized trust that doesn't rely on some government or corporation? For example: https://www.civic.com/ https://www.civic.com/ (disclaimer: I own CVC tokens)
- icebraining 9y ago
  It's an interesting case. I looked at their architecture diagram and at first thought "WTF is the blockchain doing there", since their process is essentially the same as Mozilla Persona, except in the latter the attestations were delivered to the user, who then delivered them to the requester (therefore keeping the provider ignorant about who was the requester, from privacy reasons). But then they talked about revocability and yeah, that's true; if an attacker tricks the provider into giving them an attestation, then the provider has no way to alert the requester if they discover the attack, since the user is mediating the conversation. The blockchain serves as a kind of neutral proxy that allows the provider and the requester to talk without meeting each other. On the other hand, the requester still has to check the blockchain periodically to see if any revocation was issued, so it's not immediate. Rather than doing that, why doesn't the requester periodically require the user to provide a fresh attestation? So yeah, I'm still not seeing why the blockchain is actually needed.
floatingatoll 9y ago
Persona’s technical implementation required permitting use of third-party cookies across domains (yoursite.com vs persona.com), which turns out to be wholly incompatible with tracking protection efforts. From a technical standpoint maybe it’s possible it could have been fixed, but it turned out that no one particularly needed a third-party “middleman” authentication service that required webmaster effort per-site—especially with OAuth2 already providing a viable, if imperfect, alternative approach.

Browsers should have taken that space long ago. Mozilla tried with Persona, but inexplicably it was abandoned. We could have granular control of our real and pseudo identities.

glenstein 9y ago

Persona is exactly where my mind went with this as well. While Yahoo was flailing, trying to find some new vision, one of the few good things they did was partner with a company that really has a vision in Mozilla. Yahoo could have moved to align the significant portion of the web under their control into compatibility with Mozilla's various efforts, such as Persona. To me that's going to go down in internet history as one of the ultimate what-ifs. I feel like it was a missed opportunity for both companies.

nathanaldensr 9y ago
We don't need companies controlling the internet, and we certainly don't want them controlling our identity systems. The current status quo is already bad enough. Where is the implementation that allows me to own my identity? Why are my user records locked away in some (many) corporation's database?
- kbenson 9y ago
  You're right that we don't need companies Co trolling g the internet, but it sure would have been nice to have a good login system backed by a company with the intentions and motivations of Mozilla (a non profit). Businesses aren't going to trade their content out of the goodness of their heart, they want something in exchange. I would much rather trade ad views through Mozilla using a list of my interests that I control than to allow excessive tracking and profile building by some untrusted third party. What we apparently have now is login collectives starting up, but who's to say how good or bad the practices are for each, or whether they have the ability to adequately secure their system.
- zerostar07 9y ago
  it could be based on some other identity provider perhaps an anonymous one, even trustless. persona was flexible with regards to authenticators. the point is, if the browser had control of the SSO, then the user could control it, not facebook or google or twitter.

ryanwaggoner 9y ago

I'm still trying to understand the cryptocurrency space and its implications, but isn't digital identity a perfect use case for the blockchain? Decentralized trust that doesn't rely on some government or corporation? For example: https://www.civic.com/ https://www.civic.com/ (disclaimer: I own CVC tokens)

icebraining 9y ago
It's an interesting case. I looked at their architecture diagram and at first thought "WTF is the blockchain doing there", since their process is essentially the same as Mozilla Persona, except in the latter the attestations were delivered to the user, who then delivered them to the requester (therefore keeping the provider ignorant about who was the requester, from privacy reasons). But then they talked about revocability and yeah, that's true; if an attacker tricks the provider into giving them an attestation, then the provider has no way to alert the requester if they discover the attack, since the user is mediating the conversation. The blockchain serves as a kind of neutral proxy that allows the provider and the requester to talk without meeting each other. On the other hand, the requester still has to check the blockchain periodically to see if any revocation was issued, so it's not immediate. Rather than doing that, why doesn't the requester periodically require the user to provide a fresh attestation? So yeah, I'm still not seeing why the blockchain is actually needed.

floatingatoll 9y ago

Persona’s technical implementation required permitting use of third-party cookies across domains (yoursite.com vs persona.com), which turns out to be wholly incompatible with tracking protection efforts. From a technical standpoint maybe it’s possible it could have been fixed, but it turned out that no one particularly needed a third-party “middleman” authentication service that required webmaster effort per-site—especially with OAuth2 already providing a viable, if imperfect, alternative approach.