7 ms·

Hi, I'm on the Persona team at Mozilla. If you'd like to learn more about what and why Mozilla is doing with authentication, I gave a 45-minute talk at PyCon US

Hi, I'm on the Persona team at Mozilla. If you'd like to learn more about what and why Mozilla is doing with authentication, I gave a 45-minute talk at PyCon US this past Saturday. You can find the video here: http://pyvideo.org/video/1764 http://pyvideo.org/video/1764 I'm also happy to answer questions in-thread or via email.

jamesaguilar 14y ago
My main question is: where is the support for the assertion made in the article title? As far as I can tell, it's just made, and then the remainder of the article treats it as a premise or a claim to be supported only with vague anecdotes. The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise. However, I'd be interested to know if you guys have some data that's not shared in the article that suggests it is.
- callahad 14y ago
  Hopefully someone else will chime in with actual citations, but we've seen a preponderance of evidence from our own user studies, from MailChimp, TechCrunch, and Voo.st's published comments, from Gawker Media's creation of an in-house non-social mechanism shortly after they tried to go social-only, and from private conversations with companies who have daily active user counts well into the millions. > The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise. I'm not sure that necessarily follows. Google's own advertising for G+ authentication touts its privacy features, which suggests that Google also believes that users are uncomfortable with social auth as it exists today. (Anecdotes aren't data, but they're what I have on hand at the moment. Sorry! Still at PyCon.)
  - jamesaguilar 14y ago
    All right. Thanks for this. Best of luck with your talk. I was nervous the last time I gave one and my audience was much smaller than yours will be. ;)
    - callahad 14y ago
      Thank you! I actually gave the talk a few days ago (I'm sticking around for the post-conference sprints), and I think it went well. In the future, I'd love to have hard data ready to cite in response to your question. I'll try to gather some once I get back home.
  - derleth 14y ago
    > touts it's privacy features And again, autocorrect makes someone look the fool.
    - callahad 14y ago
      Doh! Fixed while still within the edit window. Thanks for reading my post closely enough to notice. :)
mrweasel 14y ago
I looked at Persona for a project a friend of mine is doing, and I pretty much rejected from the start. Persona seems flawed in that it assumes email as identity. I'm a developer on a e-commerce site, when we started out we assumed what Persona assumes, that email is a unique and stable identity. We found out the first day of production mode that this assumption is flawed. People changes email address all the time, it's at least as unstable as their home address, most peoples phone number is more stable. As software developers we assumed that pretty much no one would ever change their email address, or that at least they wouldn't discard their old one. Regular people however do that. They do not care about their email address. Is this something that the Persona team that given any thought. If so, what did you come up with?
- pyvek 14y ago
  Persona's about page says that you can use multiple email addresses with a single account. "Within Persona, your identity is your email address. You can use as many email addresses as you want, but you still only need one password.". - https://login.persona.org/about https://login.persona.org/about
  - mrweasel 14y ago
    It's not really clear if it maps to the same identity. I should test that. However I think it might still confuse customers. A normal user expect to be able to change their email address on the site where they do business and the "MAGIC". I think we would have been better of requiring a username, email and password, rather than using the email as the username. For a large number of people needing to have both username and email seems redundant and stupid, for real life customer... not so much. My issue is, a customer has X number of orders on our site. Then he/she changes email and expect that using the new email address the old orders are magically available. This seems naive but that is what you have to deal with. Again I should check to see if Persona indeed maps multiple emails to the same identity. It didn't seem like it when I tested it last, but I would not rule out that I did something wrong.
    - StavrosK 14y ago
JoshTriplett 14y ago
How, today, can I integrate Persona login into my site without referencing any third-party Javascript? Does any solution exist for sites that by policy only load Javascript from the same origin?
- badida 14y ago
  not yet, but we're working on it: https://github.com/mozilla/browserid/issues/3119 https://github.com/mozilla/browserid/issues/3119
hackernewbie 14y ago
Thank you so much for this system. I sincerely hope that this gets more traction than OpenID. This is the most essential feature the entire web has never had.
mcovey 14y ago
I am very happy with the way persona works, both as an end user, and how easy it is to integrate into applications. I am hoping it gets some good marketing done or whatever is needed to make more sites start using it.
tlear 14y ago
Is there a plan for iOS sdk, or perhaps you know of someone working on one that is active?
- callahad 14y ago
  Rough draft at a first iOS SDK is available as of this week: https://github.com/mozilla/persona-ios https://github.com/mozilla/persona-ios

jamesaguilar 14y ago

My main question is: where is the support for the assertion made in the article title? As far as I can tell, it's just made, and then the remainder of the article treats it as a premise or a claim to be supported only with vague anecdotes. The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise. However, I'd be interested to know if you guys have some data that's not shared in the article that suggests it is.

callahad 14y ago
Hopefully someone else will chime in with actual citations, but we've seen a preponderance of evidence from our own user studies, from MailChimp, TechCrunch, and Voo.st's published comments, from Gawker Media's creation of an in-house non-social mechanism shortly after they tried to go social-only, and from private conversations with companies who have daily active user counts well into the millions. > The proliferation of sites that only or primarily accept social logins seem to suggest that it's not a sound premise. I'm not sure that necessarily follows. Google's own advertising for G+ authentication touts its privacy features, which suggests that Google also believes that users are uncomfortable with social auth as it exists today. (Anecdotes aren't data, but they're what I have on hand at the moment. Sorry! Still at PyCon.)
- jamesaguilar 14y ago
  All right. Thanks for this. Best of luck with your talk. I was nervous the last time I gave one and my audience was much smaller than yours will be. ;)
  - callahad 14y ago
    Thank you! I actually gave the talk a few days ago (I'm sticking around for the post-conference sprints), and I think it went well. In the future, I'd love to have hard data ready to cite in response to your question. I'll try to gather some once I get back home.
- derleth 14y ago
  > touts it's privacy features And again, autocorrect makes someone look the fool.
  - callahad 14y ago
    Doh! Fixed while still within the edit window. Thanks for reading my post closely enough to notice. :)

mrweasel 14y ago

I looked at Persona for a project a friend of mine is doing, and I pretty much rejected from the start. Persona seems flawed in that it assumes email as identity. I'm a developer on a e-commerce site, when we started out we assumed what Persona assumes, that email is a unique and stable identity. We found out the first day of production mode that this assumption is flawed. People changes email address all the time, it's at least as unstable as their home address, most peoples phone number is more stable. As software developers we assumed that pretty much no one would ever change their email address, or that at least they wouldn't discard their old one. Regular people however do that. They do not care about their email address. Is this something that the Persona team that given any thought. If so, what did you come up with?

pyvek 14y ago
Persona's about page says that you can use multiple email addresses with a single account. "Within Persona, your identity is your email address. You can use as many email addresses as you want, but you still only need one password.". - https://login.persona.org/about https://login.persona.org/about
- mrweasel 14y ago
  It's not really clear if it maps to the same identity. I should test that. However I think it might still confuse customers. A normal user expect to be able to change their email address on the site where they do business and the "MAGIC". I think we would have been better of requiring a username, email and password, rather than using the email as the username. For a large number of people needing to have both username and email seems redundant and stupid, for real life customer... not so much. My issue is, a customer has X number of orders on our site. Then he/she changes email and expect that using the new email address the old orders are magically available. This seems naive but that is what you have to deal with. Again I should check to see if Persona indeed maps multiple emails to the same identity. It didn't seem like it when I tested it last, but I would not rule out that I did something wrong.
  - StavrosK 14y ago

JoshTriplett 14y ago

How, today, can I integrate Persona login into my site without referencing any third-party Javascript? Does any solution exist for sites that by policy only load Javascript from the same origin?

badida 14y ago
not yet, but we're working on it: https://github.com/mozilla/browserid/issues/3119 https://github.com/mozilla/browserid/issues/3119

hackernewbie 14y ago

Thank you so much for this system. I sincerely hope that this gets more traction than OpenID. This is the most essential feature the entire web has never had.

mcovey 14y ago

I am very happy with the way persona works, both as an end user, and how easy it is to integrate into applications. I am hoping it gets some good marketing done or whatever is needed to make more sites start using it.

tlear 14y ago

Is there a plan for iOS sdk, or perhaps you know of someone working on one that is active?

callahad 14y ago
Rough draft at a first iOS SDK is available as of this week: https://github.com/mozilla/persona-ios https://github.com/mozilla/persona-ios