5 ms·

How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up wit

by csense 14y ago

How is this different from OpenID? EDIT: Seriously, this question was downvoted within two minutes? Why? EDIT again: The best I've been able to come up with by reading the comments and docs is that they attempt to solve the same problem, but OpenID is based on the backend of the website you're logging into issuing a request to the auth server over HTTP, while Persona has the auth server issue a very-short-duration cert for a public key generated by the client.

deleted 14y ago
[deleted]
wmf 14y ago
Firefox supports Persona and they're not going to support OpenID.
- vitno 14y ago
  Can you elaborate on that? OpenID was designed to be browser-independent. Persona is essentially a distributed openID with some extra browser integration. Sure Mozilla doesn't support openID, but I'm unsure what you would want them to do...
  - wmf 14y ago
    Without browser support, you have to type your ID into every site. (I'm ignoring Nascar login because that's not distributed.) With browser support you just click to login and maybe click again to confirm.
    - cpeterso 14y ago
      Here is a Firefox add-ons to add the missing "browser support": https://addons.mozilla.org/en-US/firefox/addon/openid-for-firefox https://addons.mozilla.org/en-US/firefox/addon/openid-for-fi... (I have not actually tested this add-on myself.)
- badida 14y ago
  It's worth pointing out that, a couple of years ago, we tried to make OpenID easier through Firefox integration. There was no good way to do it. The OpenID protocol doesn't lend itself to browser mediation. (In addition to the other usability and privacy problems mentioned above.)
namespace 14y ago
http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di... While the goals are similar, the ways differ. With perosona, the focus is on emails as the identifier. In case of OpenID, the identity provider may or may not have used email id as identifier.
mcpherrinm 14y ago
Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di... In short, three big differences: 1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them. 2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal for Mozilla and for me. 3. Browser integration: The APIs are currently implemented with a javascript shim, but the browser can step in (either via native support or an extension) to provide new, exciting types of authentication -- dongles, certificates, interpretive dance via a kinect, etc.
- charlieok 14y ago
  How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)
  - callahad 14y ago
    Check out around the 16:00 mark in this video: https://www.youtube.com/watch?v=nJff23UdNAI https://www.youtube.com/watch?v=nJff23UdNAI Notice that provisioning (steps 1 and 2) and logging into a site (steps 3 and 4) are two completely independent processes, with the browser mediating any identifiable identity-provider-to-target-site communication.
  - subleq 14y ago
    Persona stores a signed statement from the IdP in your browser (currently using localStorage). Once you get the statement from your IdP verifying your identity, you can log in using the same proof many times without contacting the IdP, until it expires.
  - csense 14y ago
    The service you log into knows the identity provider's public key and a cert for the user (the user's public key signed by the identity provider). The service can verify the user's cert against the identity provider's public key with this information. The service initially contacts the identity provider to get the provider's public key, so the identity provider can infer that someone is attempting to log into the service as one of its users. Once the service has the provider's public key, it can be cached by the service until it expires, and while it's cached, the service can verify logins without contacting the server again by checking that the cert presented by the user to the service has a legitimate signature from the identity provider's public key. So if someone logs into HN using their Gmail ID (assuming both services grow support for the protocol), all Gmail knows is that at least one person attempted to log into HN using a gmail address. Who was trying to log in, whether that login was successful, and the number of other people who logged into HN with Gmail after that, are all facts that would be completely hidden from Google.
JoshTriplett 14y ago
http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di...
callahad 14y ago
In brief, Persona offers a dramatically better privacy model, developer experience, and user experience. The protocol is decentralized and designed from the ground up to be built into the browser natively. Re: Downvotes: It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating. I imagine a lot of folks here are just tired of the repetition.
- iSnow 14y ago
  >It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating It would be nice if you created a example Persona-enabled web application (some lines of gulp PHP or heck even a VirtualBox image), push it to bitbucket/github/whatever and link to the repo from http://www.mozilla.org/en-US/persona/ http://www.mozilla.org/en-US/persona/. Does not need any functionality, just a login screen using Persona and a "it works" page you reach after logging in. And maybe sample ID provider code too. Extra cookie points if the "it works" page explains the structure of this Proof of Concept application and how the Persona protocol was used. This way, a curious developer could pull the source, have a Persona-enabled template app and his own ID provider up and running in minutes and could play around with it, evangelize it in his organization etc. If it "feels" right, said developer would read the docs afterwards to move beyond the Proof of Concept.
  - callahad 14y ago
    That sounds like a great idea. We could probably build something similar on NudgePad.com (YC, WebFWD) so interested folks could quickly have a forkable, runnable Persona sandbox. Look for it soon. :)
    - iSnow 14y ago
      Great, thanks :)
stephenhuey 14y ago
vitno posted their original blog post explaining the difference, and now it's in their FAQ: https://developer.mozilla.org/en-US/docs/Persona/FAQ https://developer.mozilla.org/en-US/docs/Persona/FAQ You may also wish to take a look at the Mozilla Persona Developer FAQ: http://www.mozilla.org/en-US/persona/developer-faq/ http://www.mozilla.org/en-US/persona/developer-faq/ It's easier for users since it relies on email addresses instead of a URL, easier for developers thanks to its simple API, and tracking information is never leaked back to the identity provider.
martinced 14y ago
I didn't downvote it but I think I know why: there's a huge wave of negativity on HN and your question sounds like criticism. There are ways to formulate the same question which would be much nicer and less negative, for example: "It's great to see other solutions providing things similar to OpenID. Can anyone explain what are the differences with OpenID?" Simply writing: "How is this different from XXX?" just sounds rude and negative.
- freshhawk 14y ago
  Understand where you are coming from but this is an overreaction. An HN where you have to wrap a plain, absolutely neutral question like this in a bunch of false praise or meaningless filler words is a much much worse place than the HN that might be overly critical/negative by default (and this perception is partly false, reinforced by the cultural belief that questions are attacks).
  - yellowseed 14y ago
    On the other hand, paraphrasing what you've said to make a counter-argument: an HN where a peaceful, respectful atmosphere is sustained by thoughtfully worded comments is a much much worse place than an HN where dry, hastily worded comments take some heat.
    - Helianthus 14y ago
      Honestly, I'm not sure if your counter argument is intended to be ironic. I'm used to an Internet where you're not required to be so goddamned polite. Seems to me it becomes the spidery veneer of Silicon Valley networking; insincere, self-interested, and a corruption of what it means to be 'nice.'
      - mindcrime 14y ago
        What's wrong with being polite? It doesn't cost any extra and there are a lot of people who appreciate it.
jayfuerstenberg 14y ago
Nobody should be downvoted for simply asking a question so I upvoted you. Hope it helps a bit. EDIT: And somebody downvoted this comment. Oh no, I lost 1 HN point! What . will . I . ever . do?
Helianthus 14y ago
One way it'll be different is (presumably) users won't be confronted with a wall of possible OpenID providers. You asked a good question. HN's not very good at self-regulating. Negativity is regarded negatively in some bizarre self-perpetuation cycle.
- badida 14y ago
  Exactly right: we hate the NASCAR array of buttons that is publisher-centric, rather than user-centric. I wrote about this a few days ago on the Persona blog: http://identity.mozilla.com/post/45842909320/users-dont-like-social-login http://identity.mozilla.com/post/45842909320/users-dont-like...
drdaeman 14y ago
Persona allows you to keep your network activity private from providers. It's the same in a couple of important aspects, though: 1. You still have to remember which email you had used to login. This was heavily criticized with OpenID ("did I login with Google or MyOpenID?" kind of situation). With emails it just got worse, as you will have problem, especially if you're trying to fight spam using service-specific emails (hackernews@foo.example.org). 2. You still can't "migrate" from one email address to another. Shall your email provider go down or you lose your domain - you lose your identity. 3. You still don't own your own identity. The identity is just leased to you by your email provider (or your domain registrar).

by csense 14y ago

deleted 14y ago

[deleted]

wmf 14y ago

Firefox supports Persona and they're not going to support OpenID.

vitno 14y ago
Can you elaborate on that? OpenID was designed to be browser-independent. Persona is essentially a distributed openID with some extra browser integration. Sure Mozilla doesn't support openID, but I'm unsure what you would want them to do...
- wmf 14y ago
  Without browser support, you have to type your ID into every site. (I'm ignoring Nascar login because that's not distributed.) With browser support you just click to login and maybe click again to confirm.
  - cpeterso 14y ago
    Here is a Firefox add-ons to add the missing "browser support": https://addons.mozilla.org/en-US/firefox/addon/openid-for-firefox https://addons.mozilla.org/en-US/firefox/addon/openid-for-fi... (I have not actually tested this add-on myself.)
badida 14y ago
It's worth pointing out that, a couple of years ago, we tried to make OpenID easier through Firefox integration. There was no good way to do it. The OpenID protocol doesn't lend itself to browser mediation. (In addition to the other usability and privacy problems mentioned above.)

namespace 14y ago

http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di... While the goals are similar, the ways differ. With perosona, the focus is on emails as the identifier. In case of OpenID, the identity provider may or may not have used email id as identifier.

mcpherrinm 14y ago

Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di... In short, three big differences: 1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them. 2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal for Mozilla and for me. 3. Browser integration: The APIs are currently implemented with a javascript shim, but the browser can step in (either via native support or an extension) to provide new, exciting types of authentication -- dongles, certificates, interpretive dance via a kinect, etc.

charlieok 14y ago
How does Persona avoid the identity provider seeing what services you log into? (Assuming the provider has implemented the distributed version of the protocol, not Mozilla's fallback IdP)
- callahad 14y ago
  Check out around the 16:00 mark in this video: https://www.youtube.com/watch?v=nJff23UdNAI https://www.youtube.com/watch?v=nJff23UdNAI Notice that provisioning (steps 1 and 2) and logging into a site (steps 3 and 4) are two completely independent processes, with the browser mediating any identifiable identity-provider-to-target-site communication.
- subleq 14y ago
  Persona stores a signed statement from the IdP in your browser (currently using localStorage). Once you get the statement from your IdP verifying your identity, you can log in using the same proof many times without contacting the IdP, until it expires.
- csense 14y ago
  The service you log into knows the identity provider's public key and a cert for the user (the user's public key signed by the identity provider). The service can verify the user's cert against the identity provider's public key with this information. The service initially contacts the identity provider to get the provider's public key, so the identity provider can infer that someone is attempting to log into the service as one of its users. Once the service has the provider's public key, it can be cached by the service until it expires, and while it's cached, the service can verify logins without contacting the server again by checking that the cert presented by the user to the service has a legitimate signature from the identity provider's public key. So if someone logs into HN using their Gmail ID (assuming both services grow support for the protocol), all Gmail knows is that at least one person attempted to log into HN using a gmail address. Who was trying to log in, whether that login was successful, and the number of other people who logged into HN with Gmail after that, are all facts that would be completely hidden from Google.

JoshTriplett 14y ago

http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di...

callahad 14y ago

In brief, Persona offers a dramatically better privacy model, developer experience, and user experience. The protocol is decentralized and designed from the ground up to be built into the browser natively. Re: Downvotes: It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating. I imagine a lot of folks here are just tired of the repetition.

iSnow 14y ago
>It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating It would be nice if you created a example Persona-enabled web application (some lines of gulp PHP or heck even a VirtualBox image), push it to bitbucket/github/whatever and link to the repo from http://www.mozilla.org/en-US/persona/ http://www.mozilla.org/en-US/persona/. Does not need any functionality, just a login screen using Persona and a "it works" page you reach after logging in. And maybe sample ID provider code too. Extra cookie points if the "it works" page explains the structure of this Proof of Concept application and how the Persona protocol was used. This way, a curious developer could pull the source, have a Persona-enabled template app and his own ID provider up and running in minutes and could play around with it, evangelize it in his organization etc. If it "feels" right, said developer would read the docs afterwards to move beyond the Proof of Concept.
- callahad 14y ago
  That sounds like a great idea. We could probably build something similar on NudgePad.com (YC, WebFWD) so interested folks could quickly have a forkable, runnable Persona sandbox. Look for it soon. :)
  - iSnow 14y ago
    Great, thanks :)

stephenhuey 14y ago

vitno posted their original blog post explaining the difference, and now it's in their FAQ: https://developer.mozilla.org/en-US/docs/Persona/FAQ https://developer.mozilla.org/en-US/docs/Persona/FAQ You may also wish to take a look at the Mozilla Persona Developer FAQ: http://www.mozilla.org/en-US/persona/developer-faq/ http://www.mozilla.org/en-US/persona/developer-faq/ It's easier for users since it relies on email addresses instead of a URL, easier for developers thanks to its simple API, and tracking information is never leaked back to the identity provider.

martinced 14y ago

I didn't downvote it but I think I know why: there's a huge wave of negativity on HN and your question sounds like criticism. There are ways to formulate the same question which would be much nicer and less negative, for example: "It's great to see other solutions providing things similar to OpenID. Can anyone explain what are the differences with OpenID?" Simply writing: "How is this different from XXX?" just sounds rude and negative.

freshhawk 14y ago
Understand where you are coming from but this is an overreaction. An HN where you have to wrap a plain, absolutely neutral question like this in a bunch of false praise or meaningless filler words is a much much worse place than the HN that might be overly critical/negative by default (and this perception is partly false, reinforced by the cultural belief that questions are attacks).
- yellowseed 14y ago
  On the other hand, paraphrasing what you've said to make a counter-argument: an HN where a peaceful, respectful atmosphere is sustained by thoughtfully worded comments is a much much worse place than an HN where dry, hastily worded comments take some heat.
  - Helianthus 14y ago
    Honestly, I'm not sure if your counter argument is intended to be ironic. I'm used to an Internet where you're not required to be so goddamned polite. Seems to me it becomes the spidery veneer of Silicon Valley networking; insincere, self-interested, and a corruption of what it means to be 'nice.'
    - mindcrime 14y ago
      What's wrong with being polite? It doesn't cost any extra and there are a lot of people who appreciate it.

jayfuerstenberg 14y ago

Nobody should be downvoted for simply asking a question so I upvoted you. Hope it helps a bit. EDIT: And somebody downvoted this comment. Oh no, I lost 1 HN point! What . will . I . ever . do?

Helianthus 14y ago

One way it'll be different is (presumably) users won't be confronted with a wall of possible OpenID providers. You asked a good question. HN's not very good at self-regulating. Negativity is regarded negatively in some bizarre self-perpetuation cycle.

badida 14y ago
Exactly right: we hate the NASCAR array of buttons that is publisher-centric, rather than user-centric. I wrote about this a few days ago on the Persona blog: http://identity.mozilla.com/post/45842909320/users-dont-like-social-login http://identity.mozilla.com/post/45842909320/users-dont-like...

drdaeman 14y ago

Persona allows you to keep your network activity private from providers. It's the same in a couple of important aspects, though: 1. You still have to remember which email you had used to login. This was heavily criticized with OpenID ("did I login with Google or MyOpenID?" kind of situation). With emails it just got worse, as you will have problem, especially if you're trying to fight spam using service-specific emails (hackernews@foo.example.org). 2. You still can't "migrate" from one email address to another. Shall your email provider go down or you lose your domain - you lose your identity. 3. You still don't own your own identity. The identity is just leased to you by your email provider (or your domain registrar).