> If you run your own identity provider, you are only trusting yourself with your secret. Good point. > Also, nothing about Persona requires password-based au

> If you run your own identity provider, you are only trusting yourself with your secret. Good point. > Also, nothing about Persona requires password-based authentication -- you can use any mechanism you like to authenticate to your identity provider. Good point. However, since noöne uses SRP or anything similar, de facto you're still sharing a secret (unless you're running your own provider).