15 ms·

Announcing the First Beta Release of Persona

474 points by callahad 14y ago

sabret00the 14y ago
Have the fixed the fact that it doesn't support autofilling passwords? That alone makes it more annoying than any captcha that I've ever had to fill out.
- sabret00the 14y ago
  Find it hilarious that this got marked down and yet it's something Mozilla have spent the last week moving towards getting this fixed.
icebraining 14y ago
Support for Persona in HN would be awesome...
- fmarier 14y ago
  ...and assuming it's written in Python (is it?), it should be pretty easy to do: https://github.com/mozilla/browserid-cookbook/blob/master/python/python.cgi https://github.com/mozilla/browserid-cookbook/blob/master/py...
  - deleted 14y ago
    [deleted]
  - deleted 14y ago
    [deleted]
  - icebraining 14y ago
    Nope, HN is written in Arc: https://en.wikipedia.org/wiki/Arc_(programming_language) https://en.wikipedia.org/wiki/Arc_(programming_language)
don_draper 14y ago
One reason this looks good to me is that I trust Mozilla more than most organizations.
- lmm 14y ago
  Ideologically? Yes. Technically? Not so much.
- j_col 14y ago
  Why? Genuine question, do you think their security will be better?
  - ozten 14y ago
    The low level protocol - BrowserID - is a federated system, so the "they" in your question can be someone you trust (and Mozilla isn't hardcoded) You can use any browser and if it has native support, it will do the client side crypto. It will store your public/private keys in the client. You can use any Identity provider (email provider probably) and if they have native support, they will store you password and do 2 factor auth or whatever. This removes websites (relaying parties) from the password storage business. All they get is an email address and a way to cryptographically check to see that you owned it. The crypto that powers the BrowserID protocol is an open standard, so you can vet it. It's been designed by crypto experts in an open forum.
    - juhanima 14y ago
      One more correction. The identity/e-mail provider does not store your password, it merely signs your key for which it can use whatever authentication it wishes. Most probably the same user-id/password combo you use to read your mail, but the BrowserID does not dictate that, it is up to the provider to decide. After that the identity provider just gets requests from services that do not know its public key yet, but typically it is asked only once per service as the key is stored in a local cache. And even when the key is asked, the provider cannot know for which email verification address it is needed. All in all I think this is a great system. It puts a lot of trust in the e-mail provider, but I think that's all right as the provider already has full control of your personal e-mail anyway and hence is trusted by default.
opendomain 14y ago
I can not get Persona to work. I go to Mozilla developer network: https://developer.mozilla.org/en-US/ https://developer.mozilla.org/en-US/ , see the login button and click on it and it redirects me back to the same page. I am using Firefox 15
- ozten 14y ago
  The first run on MDN can be a little confusing. Does it work for you on http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/ ? If not, we'd love to help identify your issue https://github.com/mozilla/browserid/issues/new https://github.com/mozilla/browserid/issues/new
  - opendomain 14y ago
    Yea - there was nowhere for me to sign up. I think the problem may be the pop-up did not work on Firefox. I used Chrome and was able to create an account and then everything worked. I also tested on IE8 and had some javascript error, but just hit refresh twice and was able to login.
Too 14y ago
After reading the text twice and watching both videos i still have no clue what it actually does and how it solves the problem. I'm a few pages of skimming into the documentation now but there's no overview of what it actually does in the background. Just a load of buzzwords and awesomeness!1 of how this will revolutionize my account management and how easy the API is. Is it a password manager, a biometric system or some kind of account provider?
- beefsack 14y ago
  It's quite clever, essentially it's a system where your email address is your unique identifier, and you authenticate by clicking on a link sent to your email account. The developer reference has much more information: https://developer.mozilla.org/en-US/docs/persona https://developer.mozilla.org/en-US/docs/persona
  - Evbn 14y ago
    Isn't this basically the same as OpenID?
- slajax 14y ago
  My understanding is that it is designed to be a distributed variation to oAuth where you authenticate against an email address instead of a specific social account.
- callahad 14y ago
  It's decentralized public-key based authentication, wrapped up in an extremely user- and dev-friendly package. Francois Marier did a good job of explaining it at Kiwi PyCon 2012: https://www.youtube.com/watch?v=iZBTc7iEkQY https://www.youtube.com/watch?v=iZBTc7iEkQY (Think OpenID, but easier to use, easier to implement, and with better privacy protection.) In brief: instead of a username and password at login, you get a user's email address and cryptographically signed assertion proving their ownership of that address. The assertions are ephemeral and scoped to your site, so once you verify it, you can set a session cookie and throw away the assertion. No more password column in your database, yet you still retain a direct relationship with your users. Here's the underlying spec (working on getting it updated for Beta 1, but the principles are all there) https://github.com/mozilla/id-specs/blob/prod/browserid/index.md https://github.com/mozilla/id-specs/blob/prod/browserid/inde...
nagnatron 14y ago
I would love to see this working.
riffraff 14y ago
the "check the documentation" link goes to https://developer.mozilla.org/it/Persona https://developer.mozilla.org/it/Persona which 404s for me. Maybe not redirecting based on user location by default is a good idea.
- kalv 14y ago
  Odd it worked for me and redirected to https://developer.mozilla.org/en-US/docs/Persona https://developer.mozilla.org/en-US/docs/Persona
- callahad 14y ago
  Doh, I'll update the MDN links to go to the en-US locale by default. Sorry about that :(
petepete 14y ago
I thought [1] Mozilla Personas were themes? [1] http://www.getpersonas.com/en-US/ http://www.getpersonas.com/en-US/ Evidently I need to pay more attention.
- timmclean 14y ago
  Used to be: http://identity.mozilla.com/post/18038609895/introducing-mozilla-persona http://identity.mozilla.com/post/18038609895/introducing-moz...
  - callahad 14y ago
    Someone needs to make a Persona Persona. We're our own worst SEO enemy :) The Firefox themes were renamed to... background themes. It's just that the addons team (which owns getpersonas.org) has been hard at work on the new Mozilla Marketplace, and the Persona team has been hard at work on Persona. A few of the Persona devs are going to hack on this next month and try to get a disambiguation page deployed. We don't want theme-seekers to get lost, but we also don't want to lose people looking for the authentication system, so a straight 301 isn't ideal.
  - benatkin 14y ago
    I told them that they need to rename it with a 301 several weeks ago. They haven't. sigh
    - deleted 14y ago
      [deleted]
  - netfire 14y ago
    This link posted says they are looking to rename Personas to something different, but it doesn't look like its actually happened yet (or what it will be called). Given that the getpersonas.com website is still calling them Personas, I'd say the Personas name is still alive and well (and easily confused with the new Persona product)
- kuida0r3 14y ago
romaniv 14y ago
I think the general idea of building better auth into browsers is a wonderful and highly necessary development. However, this implementation will completely fail if the user has JavaScript blocked and there is no fallback. And yes, this is a real issue. (Though I will probably get a lot of replies that try to dismiss it in various ways.)
- callahad 14y ago
  That's a great point. Persona doesn't work well in non-JS, non-browser contexts, yet. The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system. So long as you can associate email addresses with accounts on your backend, you can use Persona with the same database you have right now.
  - Johngibb 14y ago
    Is there any way to use it for say an iPhone app interacting with web services authenticated as a user?
    - ozten 14y ago
      There have been iPhone (pancake) and Android (soup the AMO marketplace) apps and you can find the source in github. We're working on an iOS SDK, to make this polished and easy. Patches welcome, get involved! * mozilla.dev.identity mailing list * #identity on irc.mozilla.org
  - romaniv 14y ago
    Persona doesn't work well in non-JS, non-browser contexts, yet. So are there built-in, HTML-only versions for this in the works? It seems it should be possible to build some of this functionality into the browser, making it work without JS. The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system. I wouldn't call that progressive enhancement. Depending on whether the client has JS enabled, they would go through entirely different registration and auithentication processes, using different credentials. That can be very confusing to the users.
Sidnicious 14y ago
I’m not in love with Persona because it puts everyone’s eggs in one basket. I like OpenID because it works like email — choose whichever provider you fancy. If one goes sour or a nicer one pops up, websites don’t have to add support it before you can use it. And, websites can choose to expose nice “sign in with X” buttons instead of making you type in your OpenID address to sign in. On the other hand, I realize that Mozilla has made big advances in ease-of-use (for users and developers). I just hope those advances turn into an open protocol someday. P.S. I had a fleeting hope that they were announcing browser extensions (with a fallback to the way it works now). There’s still a risk of sketchy websites phishing for your Persona login. - - - All right, clearly I need to read some more docs. I apologize for making unfounded complaints against what seems to be a pretty darn awesome protocol.
- callahad 14y ago
  > I like OpenID because it works like email — choose whichever provider you fancy. Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know. :) (To be fair, OpenID Connect is working on fixing that problem) > I just hope those advances turn into an open protocol someday. You're in luck! :) The protocol is open and completely decentralized: https://github.com/mozilla/id-specs/blob/prod/browserid/index.md https://github.com/mozilla/id-specs/blob/prod/browserid/inde... Mozilla operates a few centralized services to solve the chicken-and-egg problem while bootstrapping, but they're completely optional, and they automatically fall away when a browser or email provider have native support for the BrowserID protocol.
  - waffle_ss 14y ago
    > Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know. OpenID URLs need not be opaque - I use my regular <realname>.com URL as my OpenID, and have a stub in the HTML of /index.html that points to the provider that I want to use when I authenticate (which I can change any time I please). It's called delegation. I think using DNS as an identifier is better than email (as that's kind of what it was built for), but not a viable option for the masses. Mozilla did a good job with Persona.
scribu 14y ago
I can see why they're calling it a beta release. The UX during creating a profile on developer.mozilla.org has several rough edges. For example: 1. Clicked "Sign In" and successfully create a Persona account. 2. Created a profile on MDN, with the wrong user name (oops). 3. Cancelled my Persona account in a separate tab. I'm still logged in on MDN and the "Sign Out" button doesn't work now. After 5-10 minutes, I get a "Permission Denied" page, which is correct, but not exactly the expected workflow. Also, LastPass doesn't seem to play well with Persona, but I'm hopeful it will in the future.
binarymax 14y ago
Have been messing around with BrowserID since it first went public last year (with a node.js backend) and I love it. Its so much more straightforward to implement than oauth and openid, and the fact that it's tied to your email address is perfect. I'm definitely going to be using it as my primary auth system going forward. Great job Mozilla!
- DASD 14y ago
  Do you have examples of sites that don't use Persona as the BrowserID implementation? I'd like to see how sites are handling the user prompt when there are going to be alternative providers to Mozilla's Persona service.
  - binarymax 14y ago
    No since what I do is pretty experimental side projects and fine to just use the persona end of things. Also I don't currently have anything public running right now myself (as it just entered beta so I won't release until v1.0). If you haven't tried it out yet I encourage you to do so...it only took me 30 minutes to get up and running the first time around.
  - JoshTriplett 14y ago
    Doesn't work that way; Mozilla's Persona service just serves as a shim for browsers without native support for BrowserID. On browsers with native support, Mozilla's server won't get involved at all.
- deleted 14y ago
  [deleted]
DASD 14y ago
Are there any websites with implementations that don't prompt directly for Mozilla's site(i.e. asking for your preferred BrowserID provider)? I'd like to see how clunky the interface becomes when there are more providers(such as if I want to become my own provider) than just Mozilla. Is the user then confused by asking for a provider..ala OpenID? Am I correct in presuming Persona is an implementation of BrowserID? I'm not likely to use this myself as this little gem from Mozilla's privacy policy (https://login.persona.org/privacy https://login.persona.org/privacy) gives me the shivers: "As part of the normal operation of the Persona service, Mozilla will retain a log of which sites you have disclosed your email to."
- ozten 14y ago
  Go to https://eyedee.me https://eyedee.me and create an DASD account Go to http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/ - this is a non-Mozilla RP Enter DASD@eyedee.com - This is a Primary Identity provider, source at [1] So you see there is no BrowserID provider choosing screen, it's naturally part of the flow. you enter DASD@eyedee.com and the system checks for support and delegates to eyedee.com. [1] https://github.com/mozilla/eyedee.me https://github.com/mozilla/eyedee.me
  - DASD 14y ago
    Thanks for posting the process flow. So (https://login.persona.org/sign_in https://login.persona.org/sign_in) will always be shown? If so, then how is this truly decentralized with my privacy concerns mentioned above?
    - ozten 14y ago
      If you had a browser, say Opera, with native support for the BrowserID protocol, then you would not see login.persona.org. No requests would be made to a Mozilla server. login.persona.org is two things: 1) A JavaScript shim for cross platform support (Opera + BrowserID support would avoid this) 2) A Fallback Identity provider (eyedee.me avoids this)
glassx 14y ago
Interesting changes to the API. We now have an observer API, instead of just a function that invokes the login window. https://developer.mozilla.org/en-US/docs/DOM/navigator.id https://developer.mozilla.org/en-US/docs/DOM/navigator.id I believe this merges the old BrowserID Session Management parts with Persona, or am I wrong?
- callahad 14y ago
  Yep! The Observer API does session management automatically. (Some folks don't want that, so the previous `.get()` API is still available.)
zeemonkee2 14y ago
I've implemented this for my playground/weekend project site: http://myowndamnphotos.com http://myowndamnphotos.com. It works quite well, with a few gotchas (mainly in the JS, handling the watch() event). If you're using Python the pyBrowserID library helps with some low-level details although it's easy enough with requests/urllib.
dmthompson 14y ago
Awesome work by Mozilla. I've added this to a small project of mine, and it was super simple and fast to do. I really excited to see this gain traction.
sandGorgon 14y ago
What is the self-hosted equivalent of this ? I have been struggling with this problem quite a bit. I have a bunch of web apps which are quite a bit different - off the shelf forum software, wordpress, custom code, etc. - and I want to tie them all together using a single signon. What should I be using ? I distrust myself enough to know that I would prefer not rolling my own security protocol. I know that there are solutions like Kerberos, etc. but is it really practical for a bunch of websites running on Rackspace + EC2 ?
- ozten 14y ago
  Which pieces do you care about being self-hosted? If you use Persona on all your sites, it feels very much like SSO. I use the browserid plugin (http://wordpress.org/extend/plugins/browserid/ http://wordpress.org/extend/plugins/browserid/) on my personal Wordpress site. We actually had an SSO project based on CAS v2, which we killed because Persona was a better solution.
  - sandGorgon 14y ago
    I agree about the Persona bit, but many times you are not ... shall we say "allowed" to. Since you built an SSO, could you point me in the right direction amongst self-hosted solutions. Some comparisons and pitfalls would be most welcome.
Tipzntrix 14y ago
I wonder if this will be developed into a standard, or whether Mozilla will have to be the only ones operating this service.
- ozten 14y ago
  BrowserID Protocol Spec https://github.com/mozilla/id-specs/blob/prod/browserid/index.md https://github.com/mozilla/id-specs/blob/prod/browserid/inde...
forgotusername 14y ago
I really want to believe in something like this, however you'd getting much better traction by explaining a few key details: * What the hell does the JS assertion object look like? * How do I run an independent service? * In a single page, walk me through the steps to integrate? Videos, dodgy music, overenthusiastic PFYs appeal to me much less than good documentation
- callahad 14y ago
  > What the hell does the JS assertion object look like? Needs to be updated a little bit, but check out the spec: https://github.com/mozilla/id-specs/blob/prod/browserid/index.md#backed-identity-assertion https://github.com/mozilla/id-specs/blob/prod/browserid/inde... Note: You don't have to implement this yourself! You can POST assertions to https://verifier.login.persona.org/verify https://verifier.login.persona.org/verify instead, and we'll return a JSON blob that lets you know if it was valid or not. Or you could run that same verifier locally (it's a stateless node.js server, code's on github in the mozilla/browserid repo). The exact data formats are still in flux (waiting / hoping for IETF standardization around some crypto things), so we don't recommend doing verification yourself just yet, unless you run our node.js verifier and frequently update it. We'll get that stuff locked down in one of the next Beta releases. > How do I run an independent service? https://developer.mozilla.org/en-US/docs/Persona/Implementing_a_Persona_IdP https://developer.mozilla.org/en-US/docs/Persona/Implementin... > In a single page, walk me through the steps to integrate? https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup
  - forgotusername 14y ago
    Huh :) I went in circles on the MDN site for a few minutes.
Osiris 14y ago
I just tried it on the Times Crossword page. The workflow is really simple and elegant. I put in my email address. It took a second to determine there was no Persona account, then asked for me to create a password. After that, I clicked on an authorization link in my email account and as soon as I did that it immediately logged me in. I clicked Log out and back in again and it immediately recognized me and logged me in. This is really what I was hoping to see with OpenID when it came out, but the process to set up an account and get started is much more cumbersome. I look forward to seeing native support for Persona in browsers.
- notatoad 14y ago
  It does seem a pretty elegant way to log in, the only concern i have is that it's kind of unclear what password i needed to use to login. I had already created a browserID password at some point in the past, so when i went to the times crossword and clicked sign in, i was prompted for a password. my first thought was maybe i had already signed up for the times crossword, so i tried the password i probably would have used to sign up for a site like that. nope, but it said "authenticating with your email provider". So then i tried my email password, thinking maybe it was integrating with my google account. nope. Third try was the password i had used to sign up for persona. Maybe in the future, if this sees wide adoption, they can get away with just putting some mozilla branding in the corner, but for now there should really be some explanatory text on the login window telling you that you need to enter the password you created for mozilla persona, or this is just going to confuse users.
  - Osiris 14y ago
    They've already stated that you'll be able to put your site logo and name into the login box [1]. As far as the password, I thought it was pretty clear that the password they are asking for is your Persona password, but maybe that's because I had just signed up. The point is that you'll only ever need one password, so it'll be great to be able to have one strong password rather than tens of weaker ones. [1] http://identity.mozilla.com/post/32395255498/announcing-the-first-beta-release-of-persona http://identity.mozilla.com/post/32395255498/announcing-the-...
Flenser 14y ago
Perhaps making signing in to websites really simple, in a way that verifies the users email address to the site, isn't a good idea. Once it's widely adopted spammers will start using it.
JakeSc 14y ago
My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated with losing access to my email account, should that ever happen. Yet for all its benefits, Persona still places yet more importance on protecting my single email password.
- graue 14y ago
  You could say the same about any traditional username/password signup that sends a confirmation email and allows you to reply to an email to reset your password. Ultimately, that's just relying on the security of your email, too. So while you are correct that Persona doesn't solve that problem, it doesn't make that problem any worse compared to the default option of an email-confirmed username and password.
  - infinite8s 14y ago
    I think that's what the parent post was getting at. Originally email was just used for exchanging messages, now that most sites use it to authenticate a user there is a much higher cost to losing access/having it hacked.
  - JakeSc 14y ago
    Yes, most authenticated web services offer a "forgot password" option, and their security is thus tied to your email account. However, each one of these decentralized services on its own is not as valuable as the entire ecosystem of Persona-enabled sites will be. That is, the Persona "forgot password" is a single point of failure which, if compromised, can provide access to a whole ecosystem of sites. And it will be tied to your email account.
    - graue 14y ago
      I'm still not seeing a distinction. Your email account is already a single point of failure for every account registered with that email that has a "forgot password" feature. Maybe it would help if we considered two hypothetical scenarios. A: Your email is compromised, and you're registered on 15 websites with that email, each of which has a "forgot password" option. B: Your email is compromised, and you've used Persona to sign into 15 websites. In what concrete, practical way is B a more damaging situation than A?
Ygg2 14y ago
This is just great. I do hope this replaces Facebook connect as authentication provider, though I doubt it since getting all that user info is priceless for most sites using Facebook connect. It looks very lovely.
- latchkey 14y ago
  I don't think it'll replace Facebook, it'll just be an alternative to it. We've integrated both Persona and Facebook into our site and it works great. For my business, we need more personal details about each person that we get by default with Facebook (name/age/sex). So, that integration will always be cleaner than Persona because it is just a few clicks. We've been working with BID/Persona for a while now (we're linked from the /about page) and we're huge fans. If you want to play around with it... https://www.voo.st/ https://www.voo.st/
  - JoshTriplett 14y ago
    I've seen some preliminary discussions of linking personal information to a Persona and optionally supplying it to the site at login time. If you have a need for that, you should chat with the Persona/BrowserID developers.
    - latchkey 14y ago
      It wouldn't be ideal because there would only be a limited number of people who ever took advantage of it. The model for Persona is different than Facebook. Facebook requires this data on account creation and so do we... so we just present the user with a lock out until they give it to us.
      - JoshTriplett 14y ago
        Persona could potentially note at login time that you require that information to create an account, and thus require supplying it before attempting to log in. That said, looking at what your site does, why do you need that information? I can understand why you want it, but what functionality of your site won't function without it?
SODaniel 14y ago
Seems pretty interesting, though I have to say that watching only the introduction video gives you basically NO IDEA of what the product solves or how.
kin 14y ago
how does it work with multiple users using the same browser?
- fmarier 14y ago
  When you click the "Sign in with Persona" button on a website, the dialog that pops up has a "This is not me" button which logs out the current user and allows you to login with a different email.
egfx 14y ago
Oh, This is perfect. Today was Persona implementation day for the project I'm working on and now this announcement comes. This is great for a developer area login.
benlower 14y ago
What if I don't want a site to know my email address? I currently create unique email addresses for each site. How do I do that with Persona?
- d0m 14y ago
  I'm fairly new to persona too, but when you "sign in" it lets you choose what email address to use.
- timmclean 14y ago
  It looks like it'd be pretty easy to continue that practice -- just verify more than one email address, and pick the correct one when signing into each site. Try it here: http://myfavoritebeer.org/ http://myfavoritebeer.org/ Also, there are Mailinator-like services: https://mockmyid.com/ https://mockmyid.com/
  - seanmonstar 14y ago
    Exactly. And there's even this service that tries to automate this into Persona: https://github.com/nmalkin/janus https://github.com/nmalkin/janus
  - deleted 14y ago
    [deleted]
spoletto 14y ago
If I understand correctly, the browser stores a certificate that proves you own your email address. These certificates are only valid for a certain amount of time, even if you check that you own this computer. So what happens when your cert expires? Do you have to go back to your email and re-click the link that gives you a new cert to be stored in your browser? Also, if I'm using a public computer, is there a way for me to manually revoke a cert when I'm done using the machine? It seems that even a 1hr expiry is too long for this case.
- callahad 14y ago
  This is the part that gets kind of confusing because there isn't a clear delineation between Persona the UI and Persona the fallback identity provider (IdP). When your cert expires, you need to get a new one from your IdP. If you already have an active session with your IdP (either by logging into your webmail, or clicking the "this is my computer" button for Mozilla's fallback), then your browser can get a new cert completely invisibly. If your session and your cert have expired, then you get prompted to authenticate again. For the Persona fallback, this means you'll be prompted for your Persona password (instead of sending you back to your email, because that's super annoying and users end up not logging into your site). If your email provider has native support for Persona, then you'll get prompted by them however they normally do login. > I'm using a public computer, is there a way for me to manually revoke a cert when I'm done using the machine? Go to login.persona.org and click "sign out." We're working on universal signout (at least for users of the fallback), but I'm not sure if that's landed in production yet.
  - bwood 14y ago
    Thanks for the detail, I really like what I see with Persona so far.
- bwood 14y ago
  I get the impression that verifying your email address only needs to be done once when you first sign up with Persona and create a password. When you use Persona to log in to a site for the first time in that browser, it prompts you for your Persona password and issues a certificate on success. If that certificate expires, I presume you would have to use your password again with Persona to get a new certificate. I haven't found anything about manually revoking a cert, but I haven't looked either.
BryanB55 14y ago
This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email password is usually a 50 character random string that I don't like entering on public computers if I even could. So if I want to log in to a crossword puzzle I almost feel like I have to compromise my email password which is much more valuable, if say the public computer has a key logger or something. Maybe I'm over thinking. I could see how this would be useful if I have my desktop mail client running and just click a link to log in though.
- ThaddeusQuay2 14y ago
  "my email password is usually a 50 character random string that I don't like entering on public computers if I even could" "I almost feel like I have to compromise my email password which is much more valuable" I understand your concern. I suggest using either two-factor authentication (such as Google's) or creating a "throwaway" email account just for this purpose.
- deleted 14y ago
  [deleted]
- zerostar07 14y ago
  Then you would not use your primary "super secure" email as your browserId, but a secondary mail account.
  - loumf 14y ago
    The most valuable thing about your email account is that it's your password recovery mechanism. What ever email account you use for password recovery or logging into things becomes the "super secure" email account. There is no message in my email that I care more about than the one that might give you access to my bank accounts.
mey 14y ago
Am I entirely missing something, but once a password is selected, is there no way to change it?
- mey 14y ago
  Apparently you can by going to http://persona.org http://persona.org
- fmarier 14y ago
  You can manage your account (e.g. change password, remove emails) by signing into https://login.persona.org https://login.persona.org .
qikquestion 14y ago
Let me add my understanding. Please correct me if it is wrong. Actual user case if everything is in place: 1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/) 2.hit the login link. Give your email address (superuser123@gmail.com or superuser123@yahoo.com) 3.it prompts for your password - gmail password or yahoo password 4.post authentication it takes you to the website with user session as superuser123@gmail.com/superuser123@yahoo.com - eg crossword.thetimes.co.uk 5.In a nutshell, end user doesn't need to create a new userid & password for using the website, as long as he knows his emailuserd/emailpassword Present use case - since few things are missing 1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/) 2.hit the login link. since gmail & yahoo as email providers not implemented browserid/persona protocol, you will asked to create an account in persona.org with any of your existing email address.(gmail / yahoo). persona.org will send you a verification link to check if you really own your email address. Click on the verification link and you are verified to use persona.org account in all the places where browserid is supported 3.in the login page - it prompts for a new password if you are a new user or existing password if you are a returning user - this is the password for the email address used in persona.org registration. 4.post authentication it takes you to the website with user session as superuser123@gmail.com/superuser123@yahoo.com - eg crossword.thetimes.co.uk 5.In a nutshell, two things will change in future - no login window from persona.org & no need to create account in persona.org
- callahad 14y ago
  That's completely spot on. Right now, if your email provider doesn't have native support, we ask you to create a persona.org account so that Mozilla can vouch for you. In the future, this goes away. Similarly, the UI is all displayed in response to navigator.id.* functions. If a browser implements those natively, the Persona UI at login.persona.org completely goes away. The more successful Persona is, the less Mozilla is involved in the login process. :)
  - zerostar07 14y ago
    So if i signup now with my @gmail account through persona.org, what happens when google starts supporting browserid natively?
johnkchow 14y ago
I personally feel the pain point of password/identity management across different websites, and I'm using LastPass to help. While LastPass's browser integration is great, its UX is... lacking. Mozilla's strategy to associate Firefox browser with identity is IMO awesome and the first sign that it's pioneering vs reacting to Chrome (before this news, I've always viewed Firefox as Chrome's successful but still little brother in terms of features, polish, performance, support, etc.). BUT (and this is a big "but" I feel), this is contingent with their execution of browser integration. W/O rock solid browser integration with fluid UX, this would just add noise to identity services and cause more consumer confusion. Ultimately, I'm rooting them on because a) I'm concerned about my security and b) I have too many passwords and c) I'm hella lazy.
- donrhummy 14y ago
  Persona doesn't require any browser integration. It works in all browsers that implement local storage. So it works via modern Javascript.
  - johnkchow 14y ago
    I'm sure Firefox will release a Firefox plugin that will complement the basic service of identification. Imagine a plugin that lists all the websites you can authenticate with Persona. Or what if you had multiple personas, the firefox plugin can help you manage the selection of personas. Eventually, it'd become baked into Firefox, giving users that sense of it fundamentally "safer" than other browsers. Sure, this is all speculation, but it's a good marketing strategy on Mozilla's end and the start of gaining back the average consumer market share.
    - jedp 14y ago
      Hi, John, you have some cool ideas there! Hope to see you hacking on Persona. As a member of the team, I just want to clarify that this is not an effort to make firefox alone more secure; it's an effort to make the web more secure. Any browser vendor can implement the protocol, natively or in a plugin, and we hope other browsers will. Same for identity providers. The spec and code are all open-source: https://github.com/mozilla/browserid https://github.com/mozilla/browserid So Mozilla's strategy remains the same: Put the users of the internet first. That's why we made this.
asymmetric 14y ago
This looks really great. Only problem I see is the lack of support for IE 6 and 7, and it seems they won't be in the future. Anybody knows why that is?
- deleted 14y ago
  [deleted]
- callahad 14y ago
  The Persona cross-browser support shim needs window.postMessage and the HTML5 storage APIs, which IE 7 doesn't have. Working around it didn't seem worth the security and maintainability cost to the codebase, nor the opportunity cost over working on other features.
betterth 14y ago
I dislike that a Google search for "Mozilla Persona" returns Firefox Personas first, meaning that Mozilla now has 'Persona' and 'Personas' projects that are totally and completely unrelated to one another. Something has to give because if it confuses a Hacker News reader, it's going to go completely over the head of the average computer user.
- zerostar07 14y ago
  Supposedly, end users will only face the "login with browserid" buttons. But yeah, i find the name change from browserid to Persona, as first time users will be confused.
donrhummy 14y ago
Can someone explain how this is distributed and not using a central "authority"? I know it caches things locally, but it still requires Mozilla's Persona.org servers, correct? And you need a password that Mozilla stores, so aren't their servers still vulnerable? And couldn't (dumb) people still choose "123456" as their persona password? I understand that this makes the sites with crappy security implementations better, but some of the weaknesses are still there, right?
- tofumatt 14y ago
  I believe the aim is to have email providers be able to auth your persona email instead of Mozilla, but Mozilla exists as a sort of polyfill if the provider (eg. hotmail.com, gmail.com, your-custom-domain.net) doesn't do persona yet. Also, yes: people can still choose crummy passwords. Personally, I don't think the appeal is in better security; it's convenience of single sign-on without it being tied to a. identity or b. Facebook (or twitter or google or whatever other service that harvests my data).
  - donrhummy 14y ago
    Right, but the email providers are only authenticating you to Persona. As far as the websites using Persona are concerned, it's persona.org that authenticates you. And the appeal that Mozilla is pushing is definitely better security (as well as a distributed security authentication versus one for-profit authority - I definitely trust Mozilla MUCH more than Facebook or twitter, but it's still a central authority). You can especially see this in the talk they gave introducing it: http://www.youtube.com/watch?v=iZBTc7iEkQY http://www.youtube.com/watch?v=iZBTc7iEkQY
    - ozten 14y ago
      As a website you can do local verification of the log in assertion. Mozilla hosts a verifier as a convenience, but you don't have to use it.
      - donrhummy 14y ago
zerostar07 14y ago
I don't know if it's appropriate but can we list some of websites where one can login through browserID? I 'm a big fan of browserID, and would gladly beta test your integration.
- jedp 14y ago
  Sure thing. In addition to many of Mozilla's own sites, here are some examples: - Times Crossword: http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/ - Openphoto: http://current.openphoto.me/ http://current.openphoto.me/ - Voost: https://www.voo.st/ https://www.voo.st/ Our test application is this notepad application: http://123done.org/ http://123done.org/ (which you can clone from github)
  - zerostar07 14y ago
    Been using it for a while on http://noteplz.com/ http://noteplz.com/ too
  - deleted 14y ago
    [deleted]
johnkchow 14y ago
As a user I definitely appreciate the emphasis of privacy first as well as its clear responsibility for identification. However, from how I see it on the surface, it currently doesn't have the market reach as, say, FB Connect or Google, and I don't want to "flood" my users with too many options for authentication. What's the practical arguments of rolling out my own authentication (Rails + Devise) vs using Personas?
- callahad 14y ago
  It's available to any user with an email address -- you don't have to limit yourself to users that have, and are willing to use, a Facebook or Google account. Versus rolling your own, you don't have the friction of account creation / password management for new user signups if the user has ever used Persona before, and we'll be dramatically improving first-contact before the end of the year. You can completely forget about storing passwords. You don't have to send email verifications or handle forgotten passwords.
  - johnkchow 14y ago
    Ah so true, email verifications and forgotten passwords can become a hassle. Thanks for the insight callahad.
AndrewDucker 14y ago
I'm hoping that a large email provider (like gmail) will support this soon. Getting providers onboard with this will be the make or break factor. And I'd really like it to succeed.
zachinglis 14y ago
That intro video really doesn't explain much. I know it takes 15 minutes to integrate into my site, and works with any browser, but I have no idea why I truly want to spend those 15 minutes doing so.
lifeisstillgood 14y ago
Got it spliced into the site i am working on, checked in to github, and my laptop crashes. Karma oh karma. This looks great, I got an identity service plugged in in hours, into a OSS website and this will kick openids bottom. Brilliant - Mozilla is hitting some incredible high notes right now
- ozten 14y ago
  I'm seriously digging the positive, participation and hacking vibe in these comments! The web and OSS is so amazing.
astro1138 14y ago
Beta? I've made my own persona years ago: http://www.getpersonas.com/en-US/persona/95515 http://www.getpersonas.com/en-US/persona/95515
pablocubico 14y ago
For those of you asking, you can find some more background on how BrowserID here: http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works
jorangreef 14y ago
Does Persona do MFA?
olivier1664 14y ago
As far as I understand http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works , the browser will hold a "certificate of ownership of the email". Since browser do not yet implement Persona, it is done in javascript with https://login.persona.org/include.js https://login.persona.org/include.js . I do not yet understand what prevent me to steal these 'certificate of ownership of the email' by creating a web site with my own version of 'include.js'. In this malicious version, the "Assertion Generation" also send the private key to the server. After that, the server can uses the user login as he wants. It seems there is a timeout, but it allow the malicious server to log so long the time out is not ellapsed. Where I'am wrong?

474 points by callahad 14y ago

Have the fixed the fact that it doesn't support autofilling passwords? That alone makes it more annoying than any captcha that I've ever had to fill out.

sabret00the 14y ago
Find it hilarious that this got marked down and yet it's something Mozilla have spent the last week moving towards getting this fixed.

icebraining 14y ago

Support for Persona in HN would be awesome...

fmarier 14y ago
...and assuming it's written in Python (is it?), it should be pretty easy to do: https://github.com/mozilla/browserid-cookbook/blob/master/python/python.cgi https://github.com/mozilla/browserid-cookbook/blob/master/py...
- deleted 14y ago
  [deleted]
- deleted 14y ago
  [deleted]
- icebraining 14y ago
  Nope, HN is written in Arc: https://en.wikipedia.org/wiki/Arc_(programming_language) https://en.wikipedia.org/wiki/Arc_(programming_language)

don_draper 14y ago

One reason this looks good to me is that I trust Mozilla more than most organizations.

lmm 14y ago
Ideologically? Yes. Technically? Not so much.
j_col 14y ago
Why? Genuine question, do you think their security will be better?
- ozten 14y ago
  The low level protocol - BrowserID - is a federated system, so the "they" in your question can be someone you trust (and Mozilla isn't hardcoded) You can use any browser and if it has native support, it will do the client side crypto. It will store your public/private keys in the client. You can use any Identity provider (email provider probably) and if they have native support, they will store you password and do 2 factor auth or whatever. This removes websites (relaying parties) from the password storage business. All they get is an email address and a way to cryptographically check to see that you owned it. The crypto that powers the BrowserID protocol is an open standard, so you can vet it. It's been designed by crypto experts in an open forum.
  - juhanima 14y ago
    One more correction. The identity/e-mail provider does not store your password, it merely signs your key for which it can use whatever authentication it wishes. Most probably the same user-id/password combo you use to read your mail, but the BrowserID does not dictate that, it is up to the provider to decide. After that the identity provider just gets requests from services that do not know its public key yet, but typically it is asked only once per service as the key is stored in a local cache. And even when the key is asked, the provider cannot know for which email verification address it is needed. All in all I think this is a great system. It puts a lot of trust in the e-mail provider, but I think that's all right as the provider already has full control of your personal e-mail anyway and hence is trusted by default.

opendomain 14y ago

I can not get Persona to work. I go to Mozilla developer network: https://developer.mozilla.org/en-US/ https://developer.mozilla.org/en-US/ , see the login button and click on it and it redirects me back to the same page. I am using Firefox 15

ozten 14y ago
The first run on MDN can be a little confusing. Does it work for you on http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/ ? If not, we'd love to help identify your issue https://github.com/mozilla/browserid/issues/new https://github.com/mozilla/browserid/issues/new
- opendomain 14y ago
  Yea - there was nowhere for me to sign up. I think the problem may be the pop-up did not work on Firefox. I used Chrome and was able to create an account and then everything worked. I also tested on IE8 and had some javascript error, but just hit refresh twice and was able to login.

Too 14y ago

After reading the text twice and watching both videos i still have no clue what it actually does and how it solves the problem. I'm a few pages of skimming into the documentation now but there's no overview of what it actually does in the background. Just a load of buzzwords and awesomeness!1 of how this will revolutionize my account management and how easy the API is. Is it a password manager, a biometric system or some kind of account provider?

beefsack 14y ago
It's quite clever, essentially it's a system where your email address is your unique identifier, and you authenticate by clicking on a link sent to your email account. The developer reference has much more information: https://developer.mozilla.org/en-US/docs/persona https://developer.mozilla.org/en-US/docs/persona
- Evbn 14y ago
  Isn't this basically the same as OpenID?
slajax 14y ago
My understanding is that it is designed to be a distributed variation to oAuth where you authenticate against an email address instead of a specific social account.
callahad 14y ago
It's decentralized public-key based authentication, wrapped up in an extremely user- and dev-friendly package. Francois Marier did a good job of explaining it at Kiwi PyCon 2012: https://www.youtube.com/watch?v=iZBTc7iEkQY https://www.youtube.com/watch?v=iZBTc7iEkQY (Think OpenID, but easier to use, easier to implement, and with better privacy protection.) In brief: instead of a username and password at login, you get a user's email address and cryptographically signed assertion proving their ownership of that address. The assertions are ephemeral and scoped to your site, so once you verify it, you can set a session cookie and throw away the assertion. No more password column in your database, yet you still retain a direct relationship with your users. Here's the underlying spec (working on getting it updated for Beta 1, but the principles are all there) https://github.com/mozilla/id-specs/blob/prod/browserid/index.md https://github.com/mozilla/id-specs/blob/prod/browserid/inde...

nagnatron 14y ago

I would love to see this working.

riffraff 14y ago

the "check the documentation" link goes to https://developer.mozilla.org/it/Persona https://developer.mozilla.org/it/Persona which 404s for me. Maybe not redirecting based on user location by default is a good idea.

kalv 14y ago
Odd it worked for me and redirected to https://developer.mozilla.org/en-US/docs/Persona https://developer.mozilla.org/en-US/docs/Persona
callahad 14y ago
Doh, I'll update the MDN links to go to the en-US locale by default. Sorry about that :(

petepete 14y ago

I thought [1] Mozilla Personas were themes? [1] http://www.getpersonas.com/en-US/ http://www.getpersonas.com/en-US/ Evidently I need to pay more attention.

timmclean 14y ago
Used to be: http://identity.mozilla.com/post/18038609895/introducing-mozilla-persona http://identity.mozilla.com/post/18038609895/introducing-moz...
- callahad 14y ago
  Someone needs to make a Persona Persona. We're our own worst SEO enemy :) The Firefox themes were renamed to... background themes. It's just that the addons team (which owns getpersonas.org) has been hard at work on the new Mozilla Marketplace, and the Persona team has been hard at work on Persona. A few of the Persona devs are going to hack on this next month and try to get a disambiguation page deployed. We don't want theme-seekers to get lost, but we also don't want to lose people looking for the authentication system, so a straight 301 isn't ideal.
- benatkin 14y ago
  I told them that they need to rename it with a 301 several weeks ago. They haven't. sigh
  - deleted 14y ago
    [deleted]
- netfire 14y ago
  This link posted says they are looking to rename Personas to something different, but it doesn't look like its actually happened yet (or what it will be called). Given that the getpersonas.com website is still calling them Personas, I'd say the Personas name is still alive and well (and easily confused with the new Persona product)
kuida0r3 14y ago

romaniv 14y ago

I think the general idea of building better auth into browsers is a wonderful and highly necessary development. However, this implementation will completely fail if the user has JavaScript blocked and there is no fallback. And yes, this is a real issue. (Though I will probably get a lot of replies that try to dismiss it in various ways.)

callahad 14y ago
That's a great point. Persona doesn't work well in non-JS, non-browser contexts, yet. The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system. So long as you can associate email addresses with accounts on your backend, you can use Persona with the same database you have right now.
- Johngibb 14y ago
  Is there any way to use it for say an iPhone app interacting with web services authenticated as a user?
  - ozten 14y ago
    There have been iPhone (pancake) and Android (soup the AMO marketplace) apps and you can find the source in github. We're working on an iOS SDK, to make this polished and easy. Patches welcome, get involved! * mozilla.dev.identity mailing list * #identity on irc.mozilla.org
- romaniv 14y ago
  Persona doesn't work well in non-JS, non-browser contexts, yet. So are there built-in, HTML-only versions for this in the works? It seems it should be possible to build some of this functionality into the browser, making it work without JS. The nice thing is that you can use it for progressive enhancement. Users have JS? Auth with Persona. Users don't have JS? Use a traditional email address / password system. I wouldn't call that progressive enhancement. Depending on whether the client has JS enabled, they would go through entirely different registration and auithentication processes, using different credentials. That can be very confusing to the users.

Sidnicious 14y ago

I’m not in love with Persona because it puts everyone’s eggs in one basket. I like OpenID because it works like email — choose whichever provider you fancy. If one goes sour or a nicer one pops up, websites don’t have to add support it before you can use it. And, websites can choose to expose nice “sign in with X” buttons instead of making you type in your OpenID address to sign in. On the other hand, I realize that Mozilla has made big advances in ease-of-use (for users and developers). I just hope those advances turn into an open protocol someday. P.S. I had a fleeting hope that they were announcing browser extensions (with a fallback to the way it works now). There’s still a risk of sketchy websites phishing for your Persona login. - - - All right, clearly I need to read some more docs. I apologize for making unfounded complaints against what seems to be a pretty darn awesome protocol.

callahad 14y ago
> I like OpenID because it works like email — choose whichever provider you fancy. Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know. :) (To be fair, OpenID Connect is working on fixing that problem) > I just hope those advances turn into an open protocol someday. You're in luck! :) The protocol is open and completely decentralized: https://github.com/mozilla/id-specs/blob/prod/browserid/index.md https://github.com/mozilla/id-specs/blob/prod/browserid/inde... Mozilla operates a few centralized services to solve the chicken-and-egg problem while bootstrapping, but they're completely optional, and they automatically fall away when a browser or email provider have native support for the BrowserID protocol.
- waffle_ss 14y ago
  > Persona works like email because every identifier is an email address, not an opaque OpenID URL. You don't have to have the NASCAR-esque "Sign in with OpenID Provider X, Y, or Z" login page if users can actually use an identifier that that already know. OpenID URLs need not be opaque - I use my regular <realname>.com URL as my OpenID, and have a stub in the HTML of /index.html that points to the provider that I want to use when I authenticate (which I can change any time I please). It's called delegation. I think using DNS as an identifier is better than email (as that's kind of what it was built for), but not a viable option for the masses. Mozilla did a good job with Persona.

scribu 14y ago

I can see why they're calling it a beta release. The UX during creating a profile on developer.mozilla.org has several rough edges. For example: 1. Clicked "Sign In" and successfully create a Persona account. 2. Created a profile on MDN, with the wrong user name (oops). 3. Cancelled my Persona account in a separate tab. I'm still logged in on MDN and the "Sign Out" button doesn't work now. After 5-10 minutes, I get a "Permission Denied" page, which is correct, but not exactly the expected workflow. Also, LastPass doesn't seem to play well with Persona, but I'm hopeful it will in the future.

binarymax 14y ago

Have been messing around with BrowserID since it first went public last year (with a node.js backend) and I love it. Its so much more straightforward to implement than oauth and openid, and the fact that it's tied to your email address is perfect. I'm definitely going to be using it as my primary auth system going forward. Great job Mozilla!

DASD 14y ago
Do you have examples of sites that don't use Persona as the BrowserID implementation? I'd like to see how sites are handling the user prompt when there are going to be alternative providers to Mozilla's Persona service.
- binarymax 14y ago
  No since what I do is pretty experimental side projects and fine to just use the persona end of things. Also I don't currently have anything public running right now myself (as it just entered beta so I won't release until v1.0). If you haven't tried it out yet I encourage you to do so...it only took me 30 minutes to get up and running the first time around.
- JoshTriplett 14y ago
  Doesn't work that way; Mozilla's Persona service just serves as a shim for browsers without native support for BrowserID. On browsers with native support, Mozilla's server won't get involved at all.
deleted 14y ago
[deleted]

DASD 14y ago

Are there any websites with implementations that don't prompt directly for Mozilla's site(i.e. asking for your preferred BrowserID provider)? I'd like to see how clunky the interface becomes when there are more providers(such as if I want to become my own provider) than just Mozilla. Is the user then confused by asking for a provider..ala OpenID? Am I correct in presuming Persona is an implementation of BrowserID? I'm not likely to use this myself as this little gem from Mozilla's privacy policy (https://login.persona.org/privacy https://login.persona.org/privacy) gives me the shivers: "As part of the normal operation of the Persona service, Mozilla will retain a log of which sites you have disclosed your email to."

ozten 14y ago
Go to https://eyedee.me https://eyedee.me and create an DASD account Go to http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/ - this is a non-Mozilla RP Enter DASD@eyedee.com - This is a Primary Identity provider, source at [1] So you see there is no BrowserID provider choosing screen, it's naturally part of the flow. you enter DASD@eyedee.com and the system checks for support and delegates to eyedee.com. [1] https://github.com/mozilla/eyedee.me https://github.com/mozilla/eyedee.me
- DASD 14y ago
  Thanks for posting the process flow. So (https://login.persona.org/sign_in https://login.persona.org/sign_in) will always be shown? If so, then how is this truly decentralized with my privacy concerns mentioned above?
  - ozten 14y ago
    If you had a browser, say Opera, with native support for the BrowserID protocol, then you would not see login.persona.org. No requests would be made to a Mozilla server. login.persona.org is two things: 1) A JavaScript shim for cross platform support (Opera + BrowserID support would avoid this) 2) A Fallback Identity provider (eyedee.me avoids this)

glassx 14y ago

Interesting changes to the API. We now have an observer API, instead of just a function that invokes the login window. https://developer.mozilla.org/en-US/docs/DOM/navigator.id https://developer.mozilla.org/en-US/docs/DOM/navigator.id I believe this merges the old BrowserID Session Management parts with Persona, or am I wrong?

callahad 14y ago
Yep! The Observer API does session management automatically. (Some folks don't want that, so the previous `.get()` API is still available.)

zeemonkee2 14y ago

I've implemented this for my playground/weekend project site: http://myowndamnphotos.com http://myowndamnphotos.com. It works quite well, with a few gotchas (mainly in the JS, handling the watch() event). If you're using Python the pyBrowserID library helps with some low-level details although it's easy enough with requests/urllib.

dmthompson 14y ago

Awesome work by Mozilla. I've added this to a small project of mine, and it was super simple and fast to do. I really excited to see this gain traction.

sandGorgon 14y ago

What is the self-hosted equivalent of this ? I have been struggling with this problem quite a bit. I have a bunch of web apps which are quite a bit different - off the shelf forum software, wordpress, custom code, etc. - and I want to tie them all together using a single signon. What should I be using ? I distrust myself enough to know that I would prefer not rolling my own security protocol. I know that there are solutions like Kerberos, etc. but is it really practical for a bunch of websites running on Rackspace + EC2 ?

ozten 14y ago
Which pieces do you care about being self-hosted? If you use Persona on all your sites, it feels very much like SSO. I use the browserid plugin (http://wordpress.org/extend/plugins/browserid/ http://wordpress.org/extend/plugins/browserid/) on my personal Wordpress site. We actually had an SSO project based on CAS v2, which we killed because Persona was a better solution.
- sandGorgon 14y ago
  I agree about the Persona bit, but many times you are not ... shall we say "allowed" to. Since you built an SSO, could you point me in the right direction amongst self-hosted solutions. Some comparisons and pitfalls would be most welcome.

Tipzntrix 14y ago

I wonder if this will be developed into a standard, or whether Mozilla will have to be the only ones operating this service.

ozten 14y ago
BrowserID Protocol Spec https://github.com/mozilla/id-specs/blob/prod/browserid/index.md https://github.com/mozilla/id-specs/blob/prod/browserid/inde...

forgotusername 14y ago

I really want to believe in something like this, however you'd getting much better traction by explaining a few key details: * What the hell does the JS assertion object look like? * How do I run an independent service? * In a single page, walk me through the steps to integrate? Videos, dodgy music, overenthusiastic PFYs appeal to me much less than good documentation

callahad 14y ago
> What the hell does the JS assertion object look like? Needs to be updated a little bit, but check out the spec: https://github.com/mozilla/id-specs/blob/prod/browserid/index.md#backed-identity-assertion https://github.com/mozilla/id-specs/blob/prod/browserid/inde... Note: You don't have to implement this yourself! You can POST assertions to https://verifier.login.persona.org/verify https://verifier.login.persona.org/verify instead, and we'll return a JSON blob that lets you know if it was valid or not. Or you could run that same verifier locally (it's a stateless node.js server, code's on github in the mozilla/browserid repo). The exact data formats are still in flux (waiting / hoping for IETF standardization around some crypto things), so we don't recommend doing verification yourself just yet, unless you run our node.js verifier and frequently update it. We'll get that stuff locked down in one of the next Beta releases. > How do I run an independent service? https://developer.mozilla.org/en-US/docs/Persona/Implementing_a_Persona_IdP https://developer.mozilla.org/en-US/docs/Persona/Implementin... > In a single page, walk me through the steps to integrate? https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup https://developer.mozilla.org/en-US/docs/Persona/Quick_Setup
- forgotusername 14y ago
  Huh :) I went in circles on the MDN site for a few minutes.

Osiris 14y ago

I just tried it on the Times Crossword page. The workflow is really simple and elegant. I put in my email address. It took a second to determine there was no Persona account, then asked for me to create a password. After that, I clicked on an authorization link in my email account and as soon as I did that it immediately logged me in. I clicked Log out and back in again and it immediately recognized me and logged me in. This is really what I was hoping to see with OpenID when it came out, but the process to set up an account and get started is much more cumbersome. I look forward to seeing native support for Persona in browsers.

notatoad 14y ago
It does seem a pretty elegant way to log in, the only concern i have is that it's kind of unclear what password i needed to use to login. I had already created a browserID password at some point in the past, so when i went to the times crossword and clicked sign in, i was prompted for a password. my first thought was maybe i had already signed up for the times crossword, so i tried the password i probably would have used to sign up for a site like that. nope, but it said "authenticating with your email provider". So then i tried my email password, thinking maybe it was integrating with my google account. nope. Third try was the password i had used to sign up for persona. Maybe in the future, if this sees wide adoption, they can get away with just putting some mozilla branding in the corner, but for now there should really be some explanatory text on the login window telling you that you need to enter the password you created for mozilla persona, or this is just going to confuse users.
- Osiris 14y ago
  They've already stated that you'll be able to put your site logo and name into the login box [1]. As far as the password, I thought it was pretty clear that the password they are asking for is your Persona password, but maybe that's because I had just signed up. The point is that you'll only ever need one password, so it'll be great to be able to have one strong password rather than tens of weaker ones. [1] http://identity.mozilla.com/post/32395255498/announcing-the-first-beta-release-of-persona http://identity.mozilla.com/post/32395255498/announcing-the-...

Flenser 14y ago

Perhaps making signing in to websites really simple, in a way that verifies the users email address to the site, isn't a good idea. Once it's widely adopted spammers will start using it.

JakeSc 14y ago

My major concern with this, beside the eggs-in-one-basket issue, is that this places even more value on my email account. Years ago, my email account was simply used for exchanging short pieces of text with acquaintances and companies. Now it's the central key to all my authentication sessions and finances, and therefore presents a huge target for attackers. I've been looking for ways to reduce the risk associated with losing access to my email account, should that ever happen. Yet for all its benefits, Persona still places yet more importance on protecting my single email password.

graue 14y ago
You could say the same about any traditional username/password signup that sends a confirmation email and allows you to reply to an email to reset your password. Ultimately, that's just relying on the security of your email, too. So while you are correct that Persona doesn't solve that problem, it doesn't make that problem any worse compared to the default option of an email-confirmed username and password.
- infinite8s 14y ago
  I think that's what the parent post was getting at. Originally email was just used for exchanging messages, now that most sites use it to authenticate a user there is a much higher cost to losing access/having it hacked.
- JakeSc 14y ago
  Yes, most authenticated web services offer a "forgot password" option, and their security is thus tied to your email account. However, each one of these decentralized services on its own is not as valuable as the entire ecosystem of Persona-enabled sites will be. That is, the Persona "forgot password" is a single point of failure which, if compromised, can provide access to a whole ecosystem of sites. And it will be tied to your email account.
  - graue 14y ago
    I'm still not seeing a distinction. Your email account is already a single point of failure for every account registered with that email that has a "forgot password" feature. Maybe it would help if we considered two hypothetical scenarios. A: Your email is compromised, and you're registered on 15 websites with that email, each of which has a "forgot password" option. B: Your email is compromised, and you've used Persona to sign into 15 websites. In what concrete, practical way is B a more damaging situation than A?

Ygg2 14y ago

This is just great. I do hope this replaces Facebook connect as authentication provider, though I doubt it since getting all that user info is priceless for most sites using Facebook connect. It looks very lovely.

latchkey 14y ago
I don't think it'll replace Facebook, it'll just be an alternative to it. We've integrated both Persona and Facebook into our site and it works great. For my business, we need more personal details about each person that we get by default with Facebook (name/age/sex). So, that integration will always be cleaner than Persona because it is just a few clicks. We've been working with BID/Persona for a while now (we're linked from the /about page) and we're huge fans. If you want to play around with it... https://www.voo.st/ https://www.voo.st/
- JoshTriplett 14y ago
  I've seen some preliminary discussions of linking personal information to a Persona and optionally supplying it to the site at login time. If you have a need for that, you should chat with the Persona/BrowserID developers.
  - latchkey 14y ago
    It wouldn't be ideal because there would only be a limited number of people who ever took advantage of it. The model for Persona is different than Facebook. Facebook requires this data on account creation and so do we... so we just present the user with a lock out until they give it to us.
    - JoshTriplett 14y ago
      Persona could potentially note at login time that you require that information to create an account, and thus require supplying it before attempting to log in. That said, looking at what your site does, why do you need that information? I can understand why you want it, but what functionality of your site won't function without it?

SODaniel 14y ago

Seems pretty interesting, though I have to say that watching only the introduction video gives you basically NO IDEA of what the product solves or how.

kin 14y ago

how does it work with multiple users using the same browser?

fmarier 14y ago
When you click the "Sign in with Persona" button on a website, the dialog that pops up has a "This is not me" button which logs out the current user and allows you to login with a different email.

egfx 14y ago

Oh, This is perfect. Today was Persona implementation day for the project I'm working on and now this announcement comes. This is great for a developer area login.

benlower 14y ago

What if I don't want a site to know my email address? I currently create unique email addresses for each site. How do I do that with Persona?

d0m 14y ago
I'm fairly new to persona too, but when you "sign in" it lets you choose what email address to use.
timmclean 14y ago
It looks like it'd be pretty easy to continue that practice -- just verify more than one email address, and pick the correct one when signing into each site. Try it here: http://myfavoritebeer.org/ http://myfavoritebeer.org/ Also, there are Mailinator-like services: https://mockmyid.com/ https://mockmyid.com/
- seanmonstar 14y ago
  Exactly. And there's even this service that tries to automate this into Persona: https://github.com/nmalkin/janus https://github.com/nmalkin/janus
- deleted 14y ago
  [deleted]

spoletto 14y ago

If I understand correctly, the browser stores a certificate that proves you own your email address. These certificates are only valid for a certain amount of time, even if you check that you own this computer. So what happens when your cert expires? Do you have to go back to your email and re-click the link that gives you a new cert to be stored in your browser? Also, if I'm using a public computer, is there a way for me to manually revoke a cert when I'm done using the machine? It seems that even a 1hr expiry is too long for this case.

callahad 14y ago
This is the part that gets kind of confusing because there isn't a clear delineation between Persona the UI and Persona the fallback identity provider (IdP). When your cert expires, you need to get a new one from your IdP. If you already have an active session with your IdP (either by logging into your webmail, or clicking the "this is my computer" button for Mozilla's fallback), then your browser can get a new cert completely invisibly. If your session and your cert have expired, then you get prompted to authenticate again. For the Persona fallback, this means you'll be prompted for your Persona password (instead of sending you back to your email, because that's super annoying and users end up not logging into your site). If your email provider has native support for Persona, then you'll get prompted by them however they normally do login. > I'm using a public computer, is there a way for me to manually revoke a cert when I'm done using the machine? Go to login.persona.org and click "sign out." We're working on universal signout (at least for users of the fallback), but I'm not sure if that's landed in production yet.
- bwood 14y ago
  Thanks for the detail, I really like what I see with Persona so far.
bwood 14y ago
I get the impression that verifying your email address only needs to be done once when you first sign up with Persona and create a password. When you use Persona to log in to a site for the first time in that browser, it prompts you for your Persona password and issues a certificate on success. If that certificate expires, I presume you would have to use your password again with Persona to get a new certificate. I haven't found anything about manually revoking a cert, but I haven't looked either.

BryanB55 14y ago

This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email password is usually a 50 character random string that I don't like entering on public computers if I even could. So if I want to log in to a crossword puzzle I almost feel like I have to compromise my email password which is much more valuable, if say the public computer has a key logger or something. Maybe I'm over thinking. I could see how this would be useful if I have my desktop mail client running and just click a link to log in though.

ThaddeusQuay2 14y ago
"my email password is usually a 50 character random string that I don't like entering on public computers if I even could" "I almost feel like I have to compromise my email password which is much more valuable" I understand your concern. I suggest using either two-factor authentication (such as Google's) or creating a "throwaway" email account just for this purpose.
deleted 14y ago
[deleted]
zerostar07 14y ago
Then you would not use your primary "super secure" email as your browserId, but a secondary mail account.
- loumf 14y ago
  The most valuable thing about your email account is that it's your password recovery mechanism. What ever email account you use for password recovery or logging into things becomes the "super secure" email account. There is no message in my email that I care more about than the one that might give you access to my bank accounts.

mey 14y ago

Am I entirely missing something, but once a password is selected, is there no way to change it?

mey 14y ago
Apparently you can by going to http://persona.org http://persona.org
fmarier 14y ago
You can manage your account (e.g. change password, remove emails) by signing into https://login.persona.org https://login.persona.org .

qikquestion 14y ago

Let me add my understanding. Please correct me if it is wrong. Actual user case if everything is in place: 1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/) 2.hit the login link. Give your email address (superuser123@gmail.com or superuser123@yahoo.com) 3.it prompts for your password - gmail password or yahoo password 4.post authentication it takes you to the website with user session as superuser123@gmail.com/superuser123@yahoo.com - eg crossword.thetimes.co.uk 5.In a nutshell, end user doesn't need to create a new userid & password for using the website, as long as he knows his emailuserd/emailpassword Present use case - since few things are missing 1. you are in a website using browserid protocol/persona (eg. http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/) 2.hit the login link. since gmail & yahoo as email providers not implemented browserid/persona protocol, you will asked to create an account in persona.org with any of your existing email address.(gmail / yahoo). persona.org will send you a verification link to check if you really own your email address. Click on the verification link and you are verified to use persona.org account in all the places where browserid is supported 3.in the login page - it prompts for a new password if you are a new user or existing password if you are a returning user - this is the password for the email address used in persona.org registration. 4.post authentication it takes you to the website with user session as superuser123@gmail.com/superuser123@yahoo.com - eg crossword.thetimes.co.uk 5.In a nutshell, two things will change in future - no login window from persona.org & no need to create account in persona.org

callahad 14y ago
That's completely spot on. Right now, if your email provider doesn't have native support, we ask you to create a persona.org account so that Mozilla can vouch for you. In the future, this goes away. Similarly, the UI is all displayed in response to navigator.id.* functions. If a browser implements those natively, the Persona UI at login.persona.org completely goes away. The more successful Persona is, the less Mozilla is involved in the login process. :)
- zerostar07 14y ago
  So if i signup now with my @gmail account through persona.org, what happens when google starts supporting browserid natively?

johnkchow 14y ago

I personally feel the pain point of password/identity management across different websites, and I'm using LastPass to help. While LastPass's browser integration is great, its UX is... lacking. Mozilla's strategy to associate Firefox browser with identity is IMO awesome and the first sign that it's pioneering vs reacting to Chrome (before this news, I've always viewed Firefox as Chrome's successful but still little brother in terms of features, polish, performance, support, etc.). BUT (and this is a big "but" I feel), this is contingent with their execution of browser integration. W/O rock solid browser integration with fluid UX, this would just add noise to identity services and cause more consumer confusion. Ultimately, I'm rooting them on because a) I'm concerned about my security and b) I have too many passwords and c) I'm hella lazy.

donrhummy 14y ago
Persona doesn't require any browser integration. It works in all browsers that implement local storage. So it works via modern Javascript.
- johnkchow 14y ago
  I'm sure Firefox will release a Firefox plugin that will complement the basic service of identification. Imagine a plugin that lists all the websites you can authenticate with Persona. Or what if you had multiple personas, the firefox plugin can help you manage the selection of personas. Eventually, it'd become baked into Firefox, giving users that sense of it fundamentally "safer" than other browsers. Sure, this is all speculation, but it's a good marketing strategy on Mozilla's end and the start of gaining back the average consumer market share.
  - jedp 14y ago
    Hi, John, you have some cool ideas there! Hope to see you hacking on Persona. As a member of the team, I just want to clarify that this is not an effort to make firefox alone more secure; it's an effort to make the web more secure. Any browser vendor can implement the protocol, natively or in a plugin, and we hope other browsers will. Same for identity providers. The spec and code are all open-source: https://github.com/mozilla/browserid https://github.com/mozilla/browserid So Mozilla's strategy remains the same: Put the users of the internet first. That's why we made this.

asymmetric 14y ago

This looks really great. Only problem I see is the lack of support for IE 6 and 7, and it seems they won't be in the future. Anybody knows why that is?

deleted 14y ago
[deleted]
callahad 14y ago
The Persona cross-browser support shim needs window.postMessage and the HTML5 storage APIs, which IE 7 doesn't have. Working around it didn't seem worth the security and maintainability cost to the codebase, nor the opportunity cost over working on other features.

betterth 14y ago

I dislike that a Google search for "Mozilla Persona" returns Firefox Personas first, meaning that Mozilla now has 'Persona' and 'Personas' projects that are totally and completely unrelated to one another. Something has to give because if it confuses a Hacker News reader, it's going to go completely over the head of the average computer user.

zerostar07 14y ago
Supposedly, end users will only face the "login with browserid" buttons. But yeah, i find the name change from browserid to Persona, as first time users will be confused.

donrhummy 14y ago

Can someone explain how this is distributed and not using a central "authority"? I know it caches things locally, but it still requires Mozilla's Persona.org servers, correct? And you need a password that Mozilla stores, so aren't their servers still vulnerable? And couldn't (dumb) people still choose "123456" as their persona password? I understand that this makes the sites with crappy security implementations better, but some of the weaknesses are still there, right?

tofumatt 14y ago
I believe the aim is to have email providers be able to auth your persona email instead of Mozilla, but Mozilla exists as a sort of polyfill if the provider (eg. hotmail.com, gmail.com, your-custom-domain.net) doesn't do persona yet. Also, yes: people can still choose crummy passwords. Personally, I don't think the appeal is in better security; it's convenience of single sign-on without it being tied to a. identity or b. Facebook (or twitter or google or whatever other service that harvests my data).
- donrhummy 14y ago
  Right, but the email providers are only authenticating you to Persona. As far as the websites using Persona are concerned, it's persona.org that authenticates you. And the appeal that Mozilla is pushing is definitely better security (as well as a distributed security authentication versus one for-profit authority - I definitely trust Mozilla MUCH more than Facebook or twitter, but it's still a central authority). You can especially see this in the talk they gave introducing it: http://www.youtube.com/watch?v=iZBTc7iEkQY http://www.youtube.com/watch?v=iZBTc7iEkQY
  - ozten 14y ago
    As a website you can do local verification of the log in assertion. Mozilla hosts a verifier as a convenience, but you don't have to use it.
    - donrhummy 14y ago

zerostar07 14y ago

I don't know if it's appropriate but can we list some of websites where one can login through browserID? I 'm a big fan of browserID, and would gladly beta test your integration.

jedp 14y ago
Sure thing. In addition to many of Mozilla's own sites, here are some examples: - Times Crossword: http://crossword.thetimes.co.uk/ http://crossword.thetimes.co.uk/ - Openphoto: http://current.openphoto.me/ http://current.openphoto.me/ - Voost: https://www.voo.st/ https://www.voo.st/ Our test application is this notepad application: http://123done.org/ http://123done.org/ (which you can clone from github)
- zerostar07 14y ago
  Been using it for a while on http://noteplz.com/ http://noteplz.com/ too
- deleted 14y ago
  [deleted]

johnkchow 14y ago

As a user I definitely appreciate the emphasis of privacy first as well as its clear responsibility for identification. However, from how I see it on the surface, it currently doesn't have the market reach as, say, FB Connect or Google, and I don't want to "flood" my users with too many options for authentication. What's the practical arguments of rolling out my own authentication (Rails + Devise) vs using Personas?

callahad 14y ago
It's available to any user with an email address -- you don't have to limit yourself to users that have, and are willing to use, a Facebook or Google account. Versus rolling your own, you don't have the friction of account creation / password management for new user signups if the user has ever used Persona before, and we'll be dramatically improving first-contact before the end of the year. You can completely forget about storing passwords. You don't have to send email verifications or handle forgotten passwords.
- johnkchow 14y ago
  Ah so true, email verifications and forgotten passwords can become a hassle. Thanks for the insight callahad.

AndrewDucker 14y ago

I'm hoping that a large email provider (like gmail) will support this soon. Getting providers onboard with this will be the make or break factor. And I'd really like it to succeed.

zachinglis 14y ago

That intro video really doesn't explain much. I know it takes 15 minutes to integrate into my site, and works with any browser, but I have no idea why I truly want to spend those 15 minutes doing so.

lifeisstillgood 14y ago

Got it spliced into the site i am working on, checked in to github, and my laptop crashes. Karma oh karma. This looks great, I got an identity service plugged in in hours, into a OSS website and this will kick openids bottom. Brilliant - Mozilla is hitting some incredible high notes right now

ozten 14y ago
I'm seriously digging the positive, participation and hacking vibe in these comments! The web and OSS is so amazing.

astro1138 14y ago

Beta? I've made my own persona years ago: http://www.getpersonas.com/en-US/persona/95515 http://www.getpersonas.com/en-US/persona/95515

pablocubico 14y ago

For those of you asking, you can find some more background on how BrowserID here: http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works

jorangreef 14y ago

Does Persona do MFA?

olivier1664 14y ago

As far as I understand http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works , the browser will hold a "certificate of ownership of the email". Since browser do not yet implement Persona, it is done in javascript with https://login.persona.org/include.js https://login.persona.org/include.js . I do not yet understand what prevent me to steal these 'certificate of ownership of the email' by creating a web site with my own version of 'include.js'. In this malicious version, the "Assertion Generation" also send the private key to the server. After that, the server can uses the user login as he wants. It seems there is a timeout, but it allow the malicious server to log so long the time out is not ellapsed. Where I'am wrong?