6 ms·

Hi, Persona dev here. We want to do better: we want to get rid of the Persona servers altogether. As tlocke said, Persona is designed to let you choose who you

Hi, Persona dev here. We want to do better: we want to get rid of the Persona servers altogether. As tlocke said, Persona is designed to let you choose who you trust, and anything that requires centralization is considered a bug. There are 4 points of temporary centralization, each of which can be replaced independently: 1. The JS polyfill. Until we stabilize the API, we ask that you link directly to login.persona.org/include.js 2. The persona.org interface. Once browsers have native support for Persona, that will supersede both the polyfill and the persona.org interface. This is all based on what Mike Hanson called Locally Isolated Feature Domains (LIFD): http://www.open-mike.org/entry/lifding-the-web http://www.open-mike.org/entry/lifding-the-web 3. The Fallback IdP. If your email provider doesn't support Persona, Mozilla will certify your identity after you click a confirmation link sent to your email address. If your email provider does support Persona, it automatically supplants Mozilla's fallback. 4. The Hosted Verifier. Until we stabilize the data formats, we recommend that sites POST identity assertions to verifier.login.persona.org/verify for verification. The assertions necessarily contain your email address and the site you're logging into. We want this to go away soon, and François Marier has suggested a pretty slick way to get us there. Until then, we've got a strong privacy policy in place and we limit the data we log. I believe Ben Adida is going to comment more on that shortly. If you're interested in getting involved, drop me a line and I'd be happy to help you get started.

workhere-io 13y ago
Thanks for commenting - it's good to hear that you are aware of the issues and that Persona is moving in the right direction. Also: Good job on Persona - you guys deserve praise - as I said in the blog post, I'm very excited about Persona, primarily because I see it as a huge user experience improvement over the current normal sign-in flow.
- kumar303 13y ago
  To clarify more: Persona is not "moving in this direction," it has always been designed as a completely decentralized identity solution. The Persona server is just a boostrap to get it started so here's what you can do: create as many identity providers as you can! Seriously, put one in every country.
StavrosK 13y ago
If you want to get rid of the IdP right now (and you have your own domain), you can use the plug-and-play MVP IdP I wrote: https://persowna.net https://persowna.net
monsterix 13y ago
> Mozilla will certify your identity after you click a confirmation link sent to your email address. Asking email address for sign-up is perhaps important, but I'm wondering why can't it be removed completely from the process? It is a piece of friction, and potentially identifying as OP puts it in his post? Can't we be just done with the requirement of email address? Let early users, especially those who inspire the rest of the bell curve, remember their persona id with some personal questions that the user may so choose. Get rid of anything that can be gotten rid of.
- workhere-io 13y ago
  Email addresses have certain advantages: - Most everyone on the 'Net has one. - Most everyone remembers their email address (but they might not remember what usernames they used for which websites). - Email addresses are unique, so when a user signs up for Persona, they don't have to go through that time-wasting "this username is taken, try this one instead" process. - Email addresses make it easy to recover forgotten passwords. So - while I see you point - I think that email addresses are the best option.
  - monsterix 13y ago
    I mostly agree. Now this may be a bit difficult to explain, but all the logic in the points above sort of align towards the intent of achieving mass adoption. But I am afraid that mass adoption is not going to happen just like that. And it is certainly not going to depend on the fact that everyone uses email. Let's look at an ordinary user first. An ordinary user doesn't half understand the subject of privacy. He/she is rather more interested in sharing his/her best looking picture on Facebook. Or worried about landing a good job with a nice new email with all the strengths. Which is the cool app, what is the next device he can show off etc. Why would Persona matter to such a user? A type that is majority and we've counted them all in the statement 'everyone on the 'Net has one'. So this is more like opening an end of a small pipe to the atmosphere thinking that all the air will pass through it. - Most everyone on the 'Net has one. Yes. But it doesn't provide any motivation for people to go and sign-up for Persona. Hence email registration only adds to friction. - Most everyone remembers their email address (but they might not remember what usernames they used for which websites). This one is real. Since Persona is about, well, persona it is more likely to remain etched in the memory of early adopters (ignore mass adoption for a later stage) provided it is done right, kept right etc. Mozilla is an amazing and capable organization so it should experiment more given that the project itself is an ambitious experiment. - Email addresses are unique, so when a user signs up for Persona, they don't have to go through that time-wasting "this username is taken, try this one instead" process. Dumb users are dumb enough to try signing up with the same email id again. I am not very sure about Persona's positioning w.r.t same person having multiple email ids? - Email addresses make it easy to recover forgotten passwords. Agreed. However, Hacker News is a great example of why both email id and password recovery are immaterial for a product to be successful (Kudos PG!). I do agree with the simplicity of recovering forgotten password through email, but this is certainly not a show-stopper at this stage.
monsterix 13y ago
> Mozilla will certify your identity after you click a confirmation link sent to your email address. Asking email address for sign-up is perhaps important, but I'm wondering why can't it be removed completely from the process? It is a piece of friction, and potentially identifying as OP puts it in his post? Can't we be just done with the requirement of email? Let early users, those who inspire the bell curve, remember their persona id with some personal questions that the user may choose. Get rid of anything that can be gotten rid of?
jevinskie 13y ago
Is there something I can do with my domain to "enable" Persona, like SPF [0] or SSH fingerprints in DNS records? [1] [0]: https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework [1]: https://tools.ietf.org/html/rfc4255 https://tools.ietf.org/html/rfc4255
kybernetikos 13y ago
I think persona is extremely useful. The only addition I'd like is for a similar service that allows you to query an identity provider for a public key for a user.

workhere-io 13y ago

Thanks for commenting - it's good to hear that you are aware of the issues and that Persona is moving in the right direction. Also: Good job on Persona - you guys deserve praise - as I said in the blog post, I'm very excited about Persona, primarily because I see it as a huge user experience improvement over the current normal sign-in flow.

kumar303 13y ago
To clarify more: Persona is not "moving in this direction," it has always been designed as a completely decentralized identity solution. The Persona server is just a boostrap to get it started so here's what you can do: create as many identity providers as you can! Seriously, put one in every country.

StavrosK 13y ago

If you want to get rid of the IdP right now (and you have your own domain), you can use the plug-and-play MVP IdP I wrote: https://persowna.net https://persowna.net

monsterix 13y ago

> Mozilla will certify your identity after you click a confirmation link sent to your email address. Asking email address for sign-up is perhaps important, but I'm wondering why can't it be removed completely from the process? It is a piece of friction, and potentially identifying as OP puts it in his post? Can't we be just done with the requirement of email address? Let early users, especially those who inspire the rest of the bell curve, remember their persona id with some personal questions that the user may so choose. Get rid of anything that can be gotten rid of.

workhere-io 13y ago
Email addresses have certain advantages: - Most everyone on the 'Net has one. - Most everyone remembers their email address (but they might not remember what usernames they used for which websites). - Email addresses are unique, so when a user signs up for Persona, they don't have to go through that time-wasting "this username is taken, try this one instead" process. - Email addresses make it easy to recover forgotten passwords. So - while I see you point - I think that email addresses are the best option.
- monsterix 13y ago
  I mostly agree. Now this may be a bit difficult to explain, but all the logic in the points above sort of align towards the intent of achieving mass adoption. But I am afraid that mass adoption is not going to happen just like that. And it is certainly not going to depend on the fact that everyone uses email. Let's look at an ordinary user first. An ordinary user doesn't half understand the subject of privacy. He/she is rather more interested in sharing his/her best looking picture on Facebook. Or worried about landing a good job with a nice new email with all the strengths. Which is the cool app, what is the next device he can show off etc. Why would Persona matter to such a user? A type that is majority and we've counted them all in the statement 'everyone on the 'Net has one'. So this is more like opening an end of a small pipe to the atmosphere thinking that all the air will pass through it. - Most everyone on the 'Net has one. Yes. But it doesn't provide any motivation for people to go and sign-up for Persona. Hence email registration only adds to friction. - Most everyone remembers their email address (but they might not remember what usernames they used for which websites). This one is real. Since Persona is about, well, persona it is more likely to remain etched in the memory of early adopters (ignore mass adoption for a later stage) provided it is done right, kept right etc. Mozilla is an amazing and capable organization so it should experiment more given that the project itself is an ambitious experiment. - Email addresses are unique, so when a user signs up for Persona, they don't have to go through that time-wasting "this username is taken, try this one instead" process. Dumb users are dumb enough to try signing up with the same email id again. I am not very sure about Persona's positioning w.r.t same person having multiple email ids? - Email addresses make it easy to recover forgotten passwords. Agreed. However, Hacker News is a great example of why both email id and password recovery are immaterial for a product to be successful (Kudos PG!). I do agree with the simplicity of recovering forgotten password through email, but this is certainly not a show-stopper at this stage.

monsterix 13y ago

> Mozilla will certify your identity after you click a confirmation link sent to your email address. Asking email address for sign-up is perhaps important, but I'm wondering why can't it be removed completely from the process? It is a piece of friction, and potentially identifying as OP puts it in his post? Can't we be just done with the requirement of email? Let early users, those who inspire the bell curve, remember their persona id with some personal questions that the user may choose. Get rid of anything that can be gotten rid of?

jevinskie 13y ago

Is there something I can do with my domain to "enable" Persona, like SPF [0] or SSH fingerprints in DNS records? [1] [0]: https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework [1]: https://tools.ietf.org/html/rfc4255 https://tools.ietf.org/html/rfc4255

kybernetikos 13y ago

I think persona is extremely useful. The only addition I'd like is for a similar service that allows you to query an identity provider for a public key for a user.