13 ms·

Mozilla should move Persona out of the US

401 points by workhere-io 13y ago

junto 13y ago
I think that the vast majority of tech companies need to seriously consider relocating outside US jurisdiction, in a similar manner to which they have already off-shored their finances.
- workhere-io 13y ago
  I agree, but it's especially important for Persona.
- mapleoin 13y ago
  I wonder if this will lead to tax-heaven countries, the same way we currently have tax-heaven countries or even something which would be equivalent to Switzerland's renown in finance.
  - junto 13y ago
    I perceive that certain countries will become super data havens. Something like Gibson noted in his book Count Zero: http://en.wikipedia.org/wiki/Data_haven#History_of_the_term http://en.wikipedia.org/wiki/Data_haven#History_of_the_term The Switzerland of data if you will. You need a durable and sizable connection to the internet, plenty of energy, strong human rights and stable governance. Iceland almost fits the bill, but their governance is not stable enough. Actually, Switzerland is actually not a bad option. They understand the necessity of privacy and are extremely stable politically. The canton principals are an excellent political stabilizer. http://en.wikipedia.org/wiki/Cantons_of_Switzerland http://en.wikipedia.org/wiki/Cantons_of_Switzerland
    - pyre 13y ago
      The US was already able to force the Swiss banking system open, so I don't see how this would protect anyone's data.
- tlrobinson 13y ago
  Is moving data centers off-shore good enough? "Microsoft admits Patriot Act can access EU-based cloud data" http://www.zdnet.com/blog/igeneration/microsoft-admits-patriot-act-can-access-eu-based-cloud-data/11225 http://www.zdnet.com/blog/igeneration/microsoft-admits-patri...
- muyuu 13y ago
  And seek another citizenship, or else they'll be paying tax twice.
tlocke 13y ago
Mozilla Persona is federated, so the BrowserId service is provided by the email provider. Mozilla provide a fallback service, in case your email provider hasn't set one up. So just pick an email provider in the country of your choice. There's another misunderstanding in the post: > Then NSA would have access to basically 40% of a user's > browsing history, including URLs, the email address used, > and time of visit. As I understand it, Persona doesn't 'phone home' each time authentication is required. It's intended that the browser authenticates you from its cache, and only refers back to the Persona server from time to time, and doesn't tell the Persona server anything about the sites you've been visiting etc.
- workhere-io 13y ago
  > Mozilla Persona is federated, so the BrowserId service is provided by the email provider. Mozilla provide a fallback service, in case your email provider hasn't set one up. So just pick an email provider in the country of your choice. The way it currently works is that when you want to log in, a pop-up window from persona.org is opened. This would make Persona able to collect data (which I don't think they're doing, but NSA could force them to). > As I understand it, Persona doesn't 'phone home' each time authentication is required I'm not an expert on the inner workings of Persona, but with the way Persona currently works it actually does fetch JS from the Persona servers on each page load. Try logging in on http://personaexamples.workhere.io/ http://personaexamples.workhere.io/ and reload the page a couple of times while checking in Firebug / Chrome Developer Tools which JS files are loaded.
  - dochtman 13y ago
    That's a (temporary) bug, not a feature: https://github.com/mozilla/browserid/issues/3119 https://github.com/mozilla/browserid/issues/3119
  - tlocke 13y ago
    You can self-host the js files wherever you like. It's not recommended that you do because Persona is still evolving. However the point is that the protocol is completely decentralized. By the way, as a plug, I've implemented it on my site http://www.polifesto.com/ http://www.polifesto.com/
andyl 13y ago
And so it begins. People who care about a strong US tech industry need to oppose government snooping.
- goldfeld 13y ago
  Opposing a strong US tech industry seems like a better bet for non-americans righ row. If the tech world were distributed across nations in a more balanced way the public would have more leverage today.
  - andyl 13y ago
    I disagree. The world needs a 'data safe haven', and it is much better for everyone if that haven is a strong country like the US. Distributed/Piecemeal efforts to maintain data security will be easy to kill.
    - louthy 13y ago
      How is the US a 'data safe haven' when the data stored by organisations within it are fair game for the US government without due process?
      - Ygg2 13y ago
        I understood grandparent's post as asking for a country with lot of political power and clout (like US) to be a data safe haven. Unfortunately I can't think of a single state that has enough power and would want to keep data safe. Russia is basically dependant on US, China is not interested in keeping it safe, etc.
    - flyinRyan 13y ago
      What on earth are you talking about! Centralized is always easier to kill than distributed. I guess what ever startup or company you work for doesn't have to worry about scaling.
      - 13y ago
rasterizer 13y ago
If you think that the US is the only country with overreaching intelligence bodies then you're deluded.
- workhere-io 13y ago
  Thanks for the snarky comment, but the fact that there are countries with overreaching intelligence agencies doesn't mean that every country is like that. In most countries a warrant will get you access to private data - but what the NSA is doing here goes far beyond that.
  - rasterizer 13y ago
    You can't know that. Canada has it: http://www.michaelgeist.ca/content/view/6870/125/ http://www.michaelgeist.ca/content/view/6870/125/ Sweden has it: https://news.ycombinator.com/item?id=5852497 https://news.ycombinator.com/item?id=5852497 http://peterfleischer.blogspot.se/2007/05/sweden-and-government-surveillance.html http://peterfleischer.blogspot.se/2007/05/sweden-and-governm...
    - zurn 13y ago
      Your linking to the laws documenting legal frameworks for eavesdropping implies we can know about them with some confidence. It would be prudent to pick countries where we can with the most confidence guess that there isn't a PRISM like system. A reasonable criteria could be: most reputable countries with law-abiding & transparent governments and best privacy laws. A list to start the research might include Swizerland, Iceland, Finland, Norway...
  - purephase 13y ago
    rasterizer is correct. I think people are misguided in believing that there are viable alternatives. The reason this is such a big deal is that the US (on paper anyway) is built on a tenet of civil liberties which is/was unique. Obviously, reality is entirely different but my point is that, in other countries/localities, these so-called fundamental freedoms either do not exist or are diminished. In most of the western world, governments have significant leeway into the private lives of their citizens in the areas covered by PRISM. I think we can be reasonably certain that programs like this already exist, or are identical, in almost any country with the technical capacity to provide similar services to the US.
rfugger 13y ago
The fact that Mozilla is a US corporation means that it will still have to give the US government the data it asks for, regardless of where the servers are hosted.
- aioprisan 13y ago
  can't an entity be incorporated in the EU that can own that piece of code, placing it out of the hands of Mozilla US?
  - reidrac 13y ago
    Potentially. There was Mozilla Europe, but according to the Wikipedia it was disbanded in 2012. https://en.wikipedia.org/wiki/Mozilla_Europe https://en.wikipedia.org/wiki/Mozilla_Europe
- jeffh 13y ago
  Just a bump to support this comment. Too many people do not realize that the privacy breaching laws (public and secret, if they are even adhered to by the govt) extend to any US entity wherever the data is in the world. This is why data on Amazon, Google or Microsoft data centers in Europe and elsewhere are still open season for US authorities. The same would apply to Mozilla.
  - gst 13y ago
    How is this compatible with European privacy laws? Wouldn't this mean European customers would be able to sue those companies over violation of this laws?
    - workhere-io 13y ago
      European privacy laws vary greatly. Even within the EU (which only covers half Europe's population) privacy laws vary a lot.
      - 13y ago
Yoric 13y ago
That doesn't sound very useful. Firstly, Persona doesn't have access to any such information. The only interesting information that could be extracted by owning a Persona server is that user X using IP Y wants to connect to some service - but Persona doesn't know which service. So you only get the IP. Secondly, well, anybody can become a Persona identity provider. Do you want to host one in insert-your-favorite-country here? Well, that's quick and easy.
- workhere-io 13y ago
  As stated elsewhere there's a difference between how Persona works now and how it eventually will work. Persona at this stage is stable and works very well, but it does communicate with and send private data to persona.org, which is owned by an American organization (Mozilla).
ck2 13y ago
NSA is good at MITM attacks according to Snowden. Moving outside the USA won't stop them. Unless it's just for politics, to feel better, then go for it.
- workhere-io 13y ago
  > NSA is good at MITM attacks according to Snowden. Moving outside the USA won't stop them. If they do MITM attacks, it will probably be on US citizens. Moving Persona out of the US would at least stop the snooping on non-US citizens.
  - BCM43 13y ago
    That's only if the traffic does not flow through the US which, given the way our current internet infrastructure is setup, is very possible
    - drzaiusapelord 13y ago
      If I have my datacenter in Iceland and you connect from France, I really doubt you'er going waste valuable transcontinental bandwidth with high latency and extra hops by routing through NYC first.
      - fotbr 13y ago
        If the US decides your France<->Iceland traffic is that valuable, it's a small matter to reach an arrangement with friendly-or-easily-pressured governments, agencies, or companies to have your traffic routed in such a way that the US can see it, whether that's in the US or not, or to just have one of those governments, agencies, or companies to play MITM and pass everything over wholesale. For that matter, go look up Ivy Bells. Sure, fiber can't be tapped in the same manner, but you can get around that by placing your splice/tap during other outages, especially if you arrange for those too -- "Here's <insert amount> dollars/euros/ducats/doubloons/etc. Drag this across the bottom from point x to point y on your charts on date z, then cut it loose and leave it behind and go on your way." Now, with a straight face, can you claim that you know, for sure, that your undersea links are pristine and unmolested, either at the end points with the equivalent of the infamous at&t "nsa rooms", or somewhere in the middle? Do you know, for sure, that the people who own the fiber trunks aren't playing ball with the nsa/mi6/dgse/etc? Unless you own the entire infrastructure, and actively monitor it to be sure of such things, it is best to assume that your communications are vulnerable at some point along the way.
chrismorgan 13y ago
It seems to me that if the NSA is able to force Mozilla to put in such tracking into Persona (which in its current form, where using the scripts at persona.org is recommended, would be possible—later on, you'd need to modify the source and get people to update to it), you don't need to worry about it in the slightest. You've already got much larger problems: putting tracking into the browser itself would be much more effective.
- workhere-io 13y ago
  Sure, but who says every major browser will be controlled by a US legal entity five years from now?
callahad 13y ago
Hi, Persona dev here. We want to do better: we want to get rid of the Persona servers altogether. As tlocke said, Persona is designed to let you choose who you trust, and anything that requires centralization is considered a bug. There are 4 points of temporary centralization, each of which can be replaced independently: 1. The JS polyfill. Until we stabilize the API, we ask that you link directly to login.persona.org/include.js 2. The persona.org interface. Once browsers have native support for Persona, that will supersede both the polyfill and the persona.org interface. This is all based on what Mike Hanson called Locally Isolated Feature Domains (LIFD): http://www.open-mike.org/entry/lifding-the-web http://www.open-mike.org/entry/lifding-the-web 3. The Fallback IdP. If your email provider doesn't support Persona, Mozilla will certify your identity after you click a confirmation link sent to your email address. If your email provider does support Persona, it automatically supplants Mozilla's fallback. 4. The Hosted Verifier. Until we stabilize the data formats, we recommend that sites POST identity assertions to verifier.login.persona.org/verify for verification. The assertions necessarily contain your email address and the site you're logging into. We want this to go away soon, and François Marier has suggested a pretty slick way to get us there. Until then, we've got a strong privacy policy in place and we limit the data we log. I believe Ben Adida is going to comment more on that shortly. If you're interested in getting involved, drop me a line and I'd be happy to help you get started.
- workhere-io 13y ago
  Thanks for commenting - it's good to hear that you are aware of the issues and that Persona is moving in the right direction. Also: Good job on Persona - you guys deserve praise - as I said in the blog post, I'm very excited about Persona, primarily because I see it as a huge user experience improvement over the current normal sign-in flow.
  - kumar303 13y ago
    To clarify more: Persona is not "moving in this direction," it has always been designed as a completely decentralized identity solution. The Persona server is just a boostrap to get it started so here's what you can do: create as many identity providers as you can! Seriously, put one in every country.
jwr 13y ago
Your site disables zooming on iOS devices, which makes it inaccessible to some of us. Please don't do that if you want people to read what you wrote.
- workhere-io 13y ago
  Sorry about that - I tested it on Android (Galaxy S3), and it worked perfectly. I'll try to test on iOS next time.
  - pietro 13y ago
    Just remove maximum-scale=1 from the viewport meta tag. It doesn't allow zooming in Safari, either.
    - workhere-io 13y ago
      Should be fixed now.
northisup 13y ago
I don't think you know how to persona...
ttrreeww 13y ago
US based technology companies can no longer be trusted.
drivebyacct2 13y ago
Why? Nothing about it is remotely centralized and eventually it won't require ANY sort of server-side resources. The entire point is that you trust who you want to be your IdP edit: never mind, reading the thread it's clear that few here have any idea what Persona is or how it works.
- workhere-io 13y ago
  As I've mentioned elsewhere on this page, there's a difference between what Persona is right now and what it will become later. Right now it is indeed centralized. Check out the integration documentation and you'll see how. https://developer.mozilla.org/en-US/docs/Mozilla/Persona/Quick_Setup https://developer.mozilla.org/en-US/docs/Mozilla/Persona/Qui...
  - drivebyacct2 13y ago
    Nope, that's the Quickstart guide. It's possible to do it without using Mozilla's servers. Someone just a couple weeks ago posted a writeup on how they did it themselves.
    - workhere-io 13y ago
      I would assume that most website owners will go with the integration method Mozilla currently recommends, and that method is centralized. For instance, the quickstart guide mentions https://login.persona.org/include.js https://login.persona.org/include.js: "You must include this on every page which uses navigator.id functions. Because Persona is still in development, you should not self-host the include.js file."
      - drivebyacct2 13y ago
        Okay, but for anyone like us, we can self-host and just make sure it stays mirrored and up to date. The only other bit is doing the verification on your own server instead of trusting them. That's as big a deal as anything.
mixedbit 13y ago
Unfortunately, you don't need to tap an authentication system to spy which services people are visiting. You can achieve the same for example by ordering a popular jQuery CDN to collect HTTP referrers, IP addresses and browsers fingerprints.
- deleted 13y ago
  [deleted]
- workhere-io 13y ago
  Suppose we found out that the NSA was snooping through the jQuery CDNs. It would only take five minutes for website owners to change their jQuery locations. It's a different story with Persona. Changing your entire user system isn't done overnight.

401 points by workhere-io 13y ago

junto 13y ago

I think that the vast majority of tech companies need to seriously consider relocating outside US jurisdiction, in a similar manner to which they have already off-shored their finances.

workhere-io 13y ago
I agree, but it's especially important for Persona.
mapleoin 13y ago
I wonder if this will lead to tax-heaven countries, the same way we currently have tax-heaven countries or even something which would be equivalent to Switzerland's renown in finance.
- junto 13y ago
  I perceive that certain countries will become super data havens. Something like Gibson noted in his book Count Zero: http://en.wikipedia.org/wiki/Data_haven#History_of_the_term http://en.wikipedia.org/wiki/Data_haven#History_of_the_term The Switzerland of data if you will. You need a durable and sizable connection to the internet, plenty of energy, strong human rights and stable governance. Iceland almost fits the bill, but their governance is not stable enough. Actually, Switzerland is actually not a bad option. They understand the necessity of privacy and are extremely stable politically. The canton principals are an excellent political stabilizer. http://en.wikipedia.org/wiki/Cantons_of_Switzerland http://en.wikipedia.org/wiki/Cantons_of_Switzerland
  - pyre 13y ago
    The US was already able to force the Swiss banking system open, so I don't see how this would protect anyone's data.
tlrobinson 13y ago
Is moving data centers off-shore good enough? "Microsoft admits Patriot Act can access EU-based cloud data" http://www.zdnet.com/blog/igeneration/microsoft-admits-patriot-act-can-access-eu-based-cloud-data/11225 http://www.zdnet.com/blog/igeneration/microsoft-admits-patri...
muyuu 13y ago
And seek another citizenship, or else they'll be paying tax twice.

tlocke 13y ago

Mozilla Persona is federated, so the BrowserId service is provided by the email provider. Mozilla provide a fallback service, in case your email provider hasn't set one up. So just pick an email provider in the country of your choice. There's another misunderstanding in the post: > Then NSA would have access to basically 40% of a user's > browsing history, including URLs, the email address used, > and time of visit. As I understand it, Persona doesn't 'phone home' each time authentication is required. It's intended that the browser authenticates you from its cache, and only refers back to the Persona server from time to time, and doesn't tell the Persona server anything about the sites you've been visiting etc.

workhere-io 13y ago
> Mozilla Persona is federated, so the BrowserId service is provided by the email provider. Mozilla provide a fallback service, in case your email provider hasn't set one up. So just pick an email provider in the country of your choice. The way it currently works is that when you want to log in, a pop-up window from persona.org is opened. This would make Persona able to collect data (which I don't think they're doing, but NSA could force them to). > As I understand it, Persona doesn't 'phone home' each time authentication is required I'm not an expert on the inner workings of Persona, but with the way Persona currently works it actually does fetch JS from the Persona servers on each page load. Try logging in on http://personaexamples.workhere.io/ http://personaexamples.workhere.io/ and reload the page a couple of times while checking in Firebug / Chrome Developer Tools which JS files are loaded.
- dochtman 13y ago
  That's a (temporary) bug, not a feature: https://github.com/mozilla/browserid/issues/3119 https://github.com/mozilla/browserid/issues/3119
- tlocke 13y ago
  You can self-host the js files wherever you like. It's not recommended that you do because Persona is still evolving. However the point is that the protocol is completely decentralized. By the way, as a plug, I've implemented it on my site http://www.polifesto.com/ http://www.polifesto.com/

andyl 13y ago

And so it begins. People who care about a strong US tech industry need to oppose government snooping.

goldfeld 13y ago
Opposing a strong US tech industry seems like a better bet for non-americans righ row. If the tech world were distributed across nations in a more balanced way the public would have more leverage today.
- andyl 13y ago
  I disagree. The world needs a 'data safe haven', and it is much better for everyone if that haven is a strong country like the US. Distributed/Piecemeal efforts to maintain data security will be easy to kill.
  - louthy 13y ago
    How is the US a 'data safe haven' when the data stored by organisations within it are fair game for the US government without due process?
    - Ygg2 13y ago
      I understood grandparent's post as asking for a country with lot of political power and clout (like US) to be a data safe haven. Unfortunately I can't think of a single state that has enough power and would want to keep data safe. Russia is basically dependant on US, China is not interested in keeping it safe, etc.
  - flyinRyan 13y ago
    What on earth are you talking about! Centralized is always easier to kill than distributed. I guess what ever startup or company you work for doesn't have to worry about scaling.
    - 13y ago

rasterizer 13y ago

If you think that the US is the only country with overreaching intelligence bodies then you're deluded.

workhere-io 13y ago
Thanks for the snarky comment, but the fact that there are countries with overreaching intelligence agencies doesn't mean that every country is like that. In most countries a warrant will get you access to private data - but what the NSA is doing here goes far beyond that.
- rasterizer 13y ago
  You can't know that. Canada has it: http://www.michaelgeist.ca/content/view/6870/125/ http://www.michaelgeist.ca/content/view/6870/125/ Sweden has it: https://news.ycombinator.com/item?id=5852497 https://news.ycombinator.com/item?id=5852497 http://peterfleischer.blogspot.se/2007/05/sweden-and-government-surveillance.html http://peterfleischer.blogspot.se/2007/05/sweden-and-governm...
  - zurn 13y ago
    Your linking to the laws documenting legal frameworks for eavesdropping implies we can know about them with some confidence. It would be prudent to pick countries where we can with the most confidence guess that there isn't a PRISM like system. A reasonable criteria could be: most reputable countries with law-abiding & transparent governments and best privacy laws. A list to start the research might include Swizerland, Iceland, Finland, Norway...
- purephase 13y ago
  rasterizer is correct. I think people are misguided in believing that there are viable alternatives. The reason this is such a big deal is that the US (on paper anyway) is built on a tenet of civil liberties which is/was unique. Obviously, reality is entirely different but my point is that, in other countries/localities, these so-called fundamental freedoms either do not exist or are diminished. In most of the western world, governments have significant leeway into the private lives of their citizens in the areas covered by PRISM. I think we can be reasonably certain that programs like this already exist, or are identical, in almost any country with the technical capacity to provide similar services to the US.

rfugger 13y ago

The fact that Mozilla is a US corporation means that it will still have to give the US government the data it asks for, regardless of where the servers are hosted.

aioprisan 13y ago
can't an entity be incorporated in the EU that can own that piece of code, placing it out of the hands of Mozilla US?
- reidrac 13y ago
  Potentially. There was Mozilla Europe, but according to the Wikipedia it was disbanded in 2012. https://en.wikipedia.org/wiki/Mozilla_Europe https://en.wikipedia.org/wiki/Mozilla_Europe
jeffh 13y ago
Just a bump to support this comment. Too many people do not realize that the privacy breaching laws (public and secret, if they are even adhered to by the govt) extend to any US entity wherever the data is in the world. This is why data on Amazon, Google or Microsoft data centers in Europe and elsewhere are still open season for US authorities. The same would apply to Mozilla.
- gst 13y ago
  How is this compatible with European privacy laws? Wouldn't this mean European customers would be able to sue those companies over violation of this laws?
  - workhere-io 13y ago
    European privacy laws vary greatly. Even within the EU (which only covers half Europe's population) privacy laws vary a lot.
    - 13y ago

Yoric 13y ago

That doesn't sound very useful. Firstly, Persona doesn't have access to any such information. The only interesting information that could be extracted by owning a Persona server is that user X using IP Y wants to connect to some service - but Persona doesn't know which service. So you only get the IP. Secondly, well, anybody can become a Persona identity provider. Do you want to host one in insert-your-favorite-country here? Well, that's quick and easy.

workhere-io 13y ago
As stated elsewhere there's a difference between how Persona works now and how it eventually will work. Persona at this stage is stable and works very well, but it does communicate with and send private data to persona.org, which is owned by an American organization (Mozilla).

ck2 13y ago

NSA is good at MITM attacks according to Snowden. Moving outside the USA won't stop them. Unless it's just for politics, to feel better, then go for it.

workhere-io 13y ago
> NSA is good at MITM attacks according to Snowden. Moving outside the USA won't stop them. If they do MITM attacks, it will probably be on US citizens. Moving Persona out of the US would at least stop the snooping on non-US citizens.
- BCM43 13y ago
  That's only if the traffic does not flow through the US which, given the way our current internet infrastructure is setup, is very possible
  - drzaiusapelord 13y ago
    If I have my datacenter in Iceland and you connect from France, I really doubt you'er going waste valuable transcontinental bandwidth with high latency and extra hops by routing through NYC first.
    - fotbr 13y ago
      If the US decides your France<->Iceland traffic is that valuable, it's a small matter to reach an arrangement with friendly-or-easily-pressured governments, agencies, or companies to have your traffic routed in such a way that the US can see it, whether that's in the US or not, or to just have one of those governments, agencies, or companies to play MITM and pass everything over wholesale. For that matter, go look up Ivy Bells. Sure, fiber can't be tapped in the same manner, but you can get around that by placing your splice/tap during other outages, especially if you arrange for those too -- "Here's <insert amount> dollars/euros/ducats/doubloons/etc. Drag this across the bottom from point x to point y on your charts on date z, then cut it loose and leave it behind and go on your way." Now, with a straight face, can you claim that you know, for sure, that your undersea links are pristine and unmolested, either at the end points with the equivalent of the infamous at&t "nsa rooms", or somewhere in the middle? Do you know, for sure, that the people who own the fiber trunks aren't playing ball with the nsa/mi6/dgse/etc? Unless you own the entire infrastructure, and actively monitor it to be sure of such things, it is best to assume that your communications are vulnerable at some point along the way.

chrismorgan 13y ago

It seems to me that if the NSA is able to force Mozilla to put in such tracking into Persona (which in its current form, where using the scripts at persona.org is recommended, would be possible—later on, you'd need to modify the source and get people to update to it), you don't need to worry about it in the slightest. You've already got much larger problems: putting tracking into the browser itself would be much more effective.

workhere-io 13y ago
Sure, but who says every major browser will be controlled by a US legal entity five years from now?

callahad 13y ago

Hi, Persona dev here. We want to do better: we want to get rid of the Persona servers altogether. As tlocke said, Persona is designed to let you choose who you trust, and anything that requires centralization is considered a bug. There are 4 points of temporary centralization, each of which can be replaced independently: 1. The JS polyfill. Until we stabilize the API, we ask that you link directly to login.persona.org/include.js 2. The persona.org interface. Once browsers have native support for Persona, that will supersede both the polyfill and the persona.org interface. This is all based on what Mike Hanson called Locally Isolated Feature Domains (LIFD): http://www.open-mike.org/entry/lifding-the-web http://www.open-mike.org/entry/lifding-the-web 3. The Fallback IdP. If your email provider doesn't support Persona, Mozilla will certify your identity after you click a confirmation link sent to your email address. If your email provider does support Persona, it automatically supplants Mozilla's fallback. 4. The Hosted Verifier. Until we stabilize the data formats, we recommend that sites POST identity assertions to verifier.login.persona.org/verify for verification. The assertions necessarily contain your email address and the site you're logging into. We want this to go away soon, and François Marier has suggested a pretty slick way to get us there. Until then, we've got a strong privacy policy in place and we limit the data we log. I believe Ben Adida is going to comment more on that shortly. If you're interested in getting involved, drop me a line and I'd be happy to help you get started.

workhere-io 13y ago
Thanks for commenting - it's good to hear that you are aware of the issues and that Persona is moving in the right direction. Also: Good job on Persona - you guys deserve praise - as I said in the blog post, I'm very excited about Persona, primarily because I see it as a huge user experience improvement over the current normal sign-in flow.
- kumar303 13y ago
  To clarify more: Persona is not "moving in this direction," it has always been designed as a completely decentralized identity solution. The Persona server is just a boostrap to get it started so here's what you can do: create as many identity providers as you can! Seriously, put one in every country.

jwr 13y ago

Your site disables zooming on iOS devices, which makes it inaccessible to some of us. Please don't do that if you want people to read what you wrote.

workhere-io 13y ago
Sorry about that - I tested it on Android (Galaxy S3), and it worked perfectly. I'll try to test on iOS next time.
- pietro 13y ago
  Just remove maximum-scale=1 from the viewport meta tag. It doesn't allow zooming in Safari, either.
  - workhere-io 13y ago
    Should be fixed now.

northisup 13y ago

I don't think you know how to persona...

ttrreeww 13y ago

US based technology companies can no longer be trusted.

drivebyacct2 13y ago

Why? Nothing about it is remotely centralized and eventually it won't require ANY sort of server-side resources. The entire point is that you trust who you want to be your IdP edit: never mind, reading the thread it's clear that few here have any idea what Persona is or how it works.

workhere-io 13y ago
As I've mentioned elsewhere on this page, there's a difference between what Persona is right now and what it will become later. Right now it is indeed centralized. Check out the integration documentation and you'll see how. https://developer.mozilla.org/en-US/docs/Mozilla/Persona/Quick_Setup https://developer.mozilla.org/en-US/docs/Mozilla/Persona/Qui...
- drivebyacct2 13y ago
  Nope, that's the Quickstart guide. It's possible to do it without using Mozilla's servers. Someone just a couple weeks ago posted a writeup on how they did it themselves.
  - workhere-io 13y ago
    I would assume that most website owners will go with the integration method Mozilla currently recommends, and that method is centralized. For instance, the quickstart guide mentions https://login.persona.org/include.js https://login.persona.org/include.js: "You must include this on every page which uses navigator.id functions. Because Persona is still in development, you should not self-host the include.js file."
    - drivebyacct2 13y ago
      Okay, but for anyone like us, we can self-host and just make sure it stays mirrored and up to date. The only other bit is doing the verification on your own server instead of trusting them. That's as big a deal as anything.

mixedbit 13y ago

Unfortunately, you don't need to tap an authentication system to spy which services people are visiting. You can achieve the same for example by ordering a popular jQuery CDN to collect HTTP referrers, IP addresses and browsers fingerprints.

deleted 13y ago
[deleted]
workhere-io 13y ago
Suppose we found out that the NSA was snooping through the jQuery CDNs. It would only take five minutes for website owners to change their jQuery locations. It's a different story with Persona. Changing your entire user system isn't done overnight.