3 ms·

Okay, I have read the specs, the FAQ, the diagrams, and tried some examples, but I can't really understand how it works. Could somebody do a quick summary for

Okay, I have read the specs, the FAQ, the diagrams, and tried some examples, but I can't really understand how it works. Could somebody do a quick summary for me? I would appreciate it very much.

callahad 14y ago
I really, really need to post something like this on our blog soon. Watch http://identity.mozilla.com/ http://identity.mozilla.com/ for something more polished next week or so. I'd also strongly urge you to just try implementing it on a site. It'll literally take less than 30 lines each of javascript on the frontend and python on the backend, and it'll really demystify the flow between the site and the user. As an analogy, we work really similarlu to showing a bouncer your ID. The ID has identifying information on it, and it has features that allow you to know that it's authentic and hasn't been tampered with. The bouncer can learn how to validate IDs issued by many different authorities, and can remember this when he sees other IDs from that same authority. Our IDs are personal public/private keypairs, signed by the email provider. So, quick and dirty, here's how we work: I want to log in to 123done.org as foobar@eyedee.me, but to do that, I need an ID with eyedee.me's digital signature on it. So in a popup, my browser sends me over to eyedee.me to ask for that signature. Before eyedee.me will sign a public key with my name on it, I have to prove that I really am who I say I am. It's just between the two of us, so I can prove my identity however eyedee.me wants. It could be a password, an RSA keyfob, or entering a code from a text message. Whatever it is, eyedee.me is happy that I am who I say I am, and they sign my key and hand it back. I want to show this to 123done.org, but it's not enough for it to be valid, since we have to prevent malicious websites or phishers from copying it and masquerading as other people. For my ID to be a valid login token, I have to add two more things: what site I'm logging in to, and a timestamp so it expires soon after I hand it over. I then sign that with my private key. I then take that whole bundle and hand it off to 123done.org. 123done verifies it by asking for eyedee.me's public key (which can be cached), and seeing if that matches the first signature on the ID. If it does, then 123done pulls out the validly signed public key, and checks if it matches the second signature on the ID. If that matches, then the whole package is valid, and 123done knows that I really am foobar@eyedee.me. Does that make sense? It really just revolves around a document with two signatures: An email provider's which says "This key is associated with this account," and a user's which says "I am associated with that key."
- Nic56 14y ago
  So in your example, eyedee.me is your email provider, right? I made a Persona account just now. All I saw happening was that I clicked on a link in a confirmation email. Was there also communication between mozilla and my email provider? (I am with a small ISP who is serving my emails - I have my own domain, so my email address is sthg like me@myname.com). What went on behind the curtains, if anything, and why did it work with my small provider right away?
  - Flimm 14y ago
    No. The fact that you had to click a link in an email is a workaround. If your email provider did support Persona, you wouldn't have had to do this. That's the great thing about Persona: it works even when email providers don't support it. However, it works best when they do.
- jackalope 14y ago
  I appreciate that you've set up real domains for demonstration purposes, but wouldn't it be better to transfer ownership to Mozilla so they show up in the whois record? I don't mean to nitpick, but details matter when trying to promote such a sensitive protocol. There's no way I'm going to try out an authentication demo at a random privately owned domain.
- carlesfe 14y ago
  Thank you so much for this explanation. For me, the big question was about whether email providers supported key signing without having to click on an email. Now I see that both ways work the same.

Okay, I have read the specs, the FAQ, the diagrams, and tried some examples, but I can't really understand how it works. Could somebody do a quick summary for me? I would appreciate it very much.

callahad 14y ago

I really, really need to post something like this on our blog soon. Watch http://identity.mozilla.com/ http://identity.mozilla.com/ for something more polished next week or so. I'd also strongly urge you to just try implementing it on a site. It'll literally take less than 30 lines each of javascript on the frontend and python on the backend, and it'll really demystify the flow between the site and the user. As an analogy, we work really similarlu to showing a bouncer your ID. The ID has identifying information on it, and it has features that allow you to know that it's authentic and hasn't been tampered with. The bouncer can learn how to validate IDs issued by many different authorities, and can remember this when he sees other IDs from that same authority. Our IDs are personal public/private keypairs, signed by the email provider. So, quick and dirty, here's how we work: I want to log in to 123done.org as foobar@eyedee.me, but to do that, I need an ID with eyedee.me's digital signature on it. So in a popup, my browser sends me over to eyedee.me to ask for that signature. Before eyedee.me will sign a public key with my name on it, I have to prove that I really am who I say I am. It's just between the two of us, so I can prove my identity however eyedee.me wants. It could be a password, an RSA keyfob, or entering a code from a text message. Whatever it is, eyedee.me is happy that I am who I say I am, and they sign my key and hand it back. I want to show this to 123done.org, but it's not enough for it to be valid, since we have to prevent malicious websites or phishers from copying it and masquerading as other people. For my ID to be a valid login token, I have to add two more things: what site I'm logging in to, and a timestamp so it expires soon after I hand it over. I then sign that with my private key. I then take that whole bundle and hand it off to 123done.org. 123done verifies it by asking for eyedee.me's public key (which can be cached), and seeing if that matches the first signature on the ID. If it does, then 123done pulls out the validly signed public key, and checks if it matches the second signature on the ID. If that matches, then the whole package is valid, and 123done knows that I really am foobar@eyedee.me. Does that make sense? It really just revolves around a document with two signatures: An email provider's which says "This key is associated with this account," and a user's which says "I am associated with that key."

Nic56 14y ago
So in your example, eyedee.me is your email provider, right? I made a Persona account just now. All I saw happening was that I clicked on a link in a confirmation email. Was there also communication between mozilla and my email provider? (I am with a small ISP who is serving my emails - I have my own domain, so my email address is sthg like me@myname.com). What went on behind the curtains, if anything, and why did it work with my small provider right away?
- Flimm 14y ago
  No. The fact that you had to click a link in an email is a workaround. If your email provider did support Persona, you wouldn't have had to do this. That's the great thing about Persona: it works even when email providers don't support it. However, it works best when they do.
jackalope 14y ago
I appreciate that you've set up real domains for demonstration purposes, but wouldn't it be better to transfer ownership to Mozilla so they show up in the whois record? I don't mean to nitpick, but details matter when trying to promote such a sensitive protocol. There's no way I'm going to try out an authentication demo at a random privately owned domain.
carlesfe 14y ago
Thank you so much for this explanation. For me, the big question was about whether email providers supported key signing without having to click on an email. Now I see that both ways work the same.