5 ms·

Can someone recommend a good article about how Persona exactly works under the hood? I've seen zillions of news about Persona but haven't grasped the main conce

by jakub_g 14y ago

Can someone recommend a good article about how Persona exactly works under the hood? I've seen zillions of news about Persona but haven't grasped the main concept. Comparison with OpenID will be appreciated also. Many of articles say that Persona is great and awesome etc. but do not explain what are the advantages and security implications.

6a68 14y ago
Here's a medium-level technical overview: https://developer.mozilla.org/en-US/docs/Persona/Protocol_Overview https://developer.mozilla.org/en-US/docs/Persona/Protocol_Ov... If that's not geeky enough, you can read the spec for the browserid protocol: https://github.com/mozilla/id-specs https://github.com/mozilla/id-specs Comparison to OpenID is covered in the FAQ page: https://developer.mozilla.org/en-US/docs/Persona/FAQ#How_does_Persona_compare_to_OpenID.3F https://developer.mozilla.org/en-US/docs/Persona/FAQ#How_doe... We've got a list of recent talks, too, in case you'd rather flip through slides or watch a video: https://wiki.mozilla.org/Identity/Spread_Persona https://wiki.mozilla.org/Identity/Spread_Persona
ecaron 14y ago
If you're looking under the hood, the mechanic's blog at http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works offers a great explanation. The Mozilla blog covered the OpenID comparison at http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di..., but it doesn't embrace the level of geekery you're likely seeking.
kibwen 14y ago
How it works under the hood: http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works Comparison to OpenID: http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di...
abhinavg 14y ago
This is off the top of my head so maybe somebody will correct me, but: Persona is a login system that cares about your privacy. With social login systems, the website you are logging into contacts the social login provider (Facebook/Google+/Twitter/what-have-you) when you attempt to log in. So you end up leaving a trail of breadcrumbs behind you of every site you visited (and used a social login on). Further, many people are not comfortable giving sites access to their social accounts because of privacy concerns. With Persona, the idea is that your identity provider (can be your email provider, persona.org , or someone else) will have a key publicly available on their site. Your browser would generate a certificate that can be verified against that key. However, since the same key from the provider is used to authenticate all accounts on that provider, all the provider finds out when a website contacts it for the key is that someone is trying to log into said website. Plus, the website could cache the certificate and now the provider does not know this either. There is more to this so you're probably better off reading one of the other links.
- drdaeman 14y ago
  If Persona would care about anyone's privacy, they won't use emails. Logging in with, say, Twitter account is less secure in aspect Twitter knows what sites you log in, but more secure in aspect the sites can't spam you unless you allow them to do so.
  - herge 14y ago
    The login string looks like an email, but it is only for convenience. Any thing that looks like an email address, and for which the domain will authenticate it using the persona protocol, can be used. Or even an address at mockmyid.com
  - Groxx 14y ago
    I've been thinking about this, and I have come to the conclusion that it's less of an issue than I thought it was. For a simple reason: the "email address" you provide is just an identifier. A string formatted as "user@domain", nothing more. By convention it's a usable email address, but there is literally nothing preventing someone from starting up an email-less Persona identity provider. You'd still log in with your_username@noemailpersona.com, but that's just a formality that doesn't need to be hooked up to an actual mail server at any point. Never using that account to actually communicate would put it on par with any other auth system you can come up with. Disposable when you want to dispose of it, and no need to ever dispose of it unless you want to. The whole issue with some people changing their email addresses for spam-fighting / inbox-cleaning purposes is a non-issue with this kind of an account.

by jakub_g 14y ago

6a68 14y ago

Here's a medium-level technical overview: https://developer.mozilla.org/en-US/docs/Persona/Protocol_Overview https://developer.mozilla.org/en-US/docs/Persona/Protocol_Ov... If that's not geeky enough, you can read the spec for the browserid protocol: https://github.com/mozilla/id-specs https://github.com/mozilla/id-specs Comparison to OpenID is covered in the FAQ page: https://developer.mozilla.org/en-US/docs/Persona/FAQ#How_does_Persona_compare_to_OpenID.3F https://developer.mozilla.org/en-US/docs/Persona/FAQ#How_doe... We've got a list of recent talks, too, in case you'd rather flip through slides or watch a video: https://wiki.mozilla.org/Identity/Spread_Persona https://wiki.mozilla.org/Identity/Spread_Persona

ecaron 14y ago

If you're looking under the hood, the mechanic's blog at http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works offers a great explanation. The Mozilla blog covered the OpenID comparison at http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di..., but it doesn't embrace the level of geekery you're likely seeking.

kibwen 14y ago

How it works under the hood: http://lloyd.io/how-browserid-works http://lloyd.io/how-browserid-works Comparison to OpenID: http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid http://identity.mozilla.com/post/7669886219/how-browserid-di...

abhinavg 14y ago

This is off the top of my head so maybe somebody will correct me, but: Persona is a login system that cares about your privacy. With social login systems, the website you are logging into contacts the social login provider (Facebook/Google+/Twitter/what-have-you) when you attempt to log in. So you end up leaving a trail of breadcrumbs behind you of every site you visited (and used a social login on). Further, many people are not comfortable giving sites access to their social accounts because of privacy concerns. With Persona, the idea is that your identity provider (can be your email provider, persona.org , or someone else) will have a key publicly available on their site. Your browser would generate a certificate that can be verified against that key. However, since the same key from the provider is used to authenticate all accounts on that provider, all the provider finds out when a website contacts it for the key is that someone is trying to log into said website. Plus, the website could cache the certificate and now the provider does not know this either. There is more to this so you're probably better off reading one of the other links.

drdaeman 14y ago
If Persona would care about anyone's privacy, they won't use emails. Logging in with, say, Twitter account is less secure in aspect Twitter knows what sites you log in, but more secure in aspect the sites can't spam you unless you allow them to do so.
- herge 14y ago
  The login string looks like an email, but it is only for convenience. Any thing that looks like an email address, and for which the domain will authenticate it using the persona protocol, can be used. Or even an address at mockmyid.com
- Groxx 14y ago
  I've been thinking about this, and I have come to the conclusion that it's less of an issue than I thought it was. For a simple reason: the "email address" you provide is just an identifier. A string formatted as "user@domain", nothing more. By convention it's a usable email address, but there is literally nothing preventing someone from starting up an email-less Persona identity provider. You'd still log in with your_username@noemailpersona.com, but that's just a formality that doesn't need to be hooked up to an actual mail server at any point. Never using that account to actually communicate would put it on par with any other auth system you can come up with. Disposable when you want to dispose of it, and no need to ever dispose of it unless you want to. The whole issue with some people changing their email addresses for spam-fighting / inbox-cleaning purposes is a non-issue with this kind of an account.