9 ms·

In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look

by drew 13y ago

In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important. I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site (http://www.sixquestions.co http://www.sixquestions.co) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our next-worst performer (Twitter), and half the rate of our best performer (Facebook). For all the concerns people have with authorizing Facebook/Twitter access, that is (in my view) offset by the alien-ness of Persona's login flow. We've heard from lots of users that logging in with Persona is unusual and they thought they were doing something wrong because they'd never seen anything like that. So, as much as I believe in Persona, I'm about to deploy a change that removes it entirely. It adds a lot of surface area to our testing and future development, but if it means we lose fewer users in their signup flow, it will be worth it.

StavrosK 13y ago
Why not keep it as a (perhaps less prominent) alternative?
cheshire137 13y ago
Just tried it on your site. It went easily enough. I entered my Gmail address in the Persona form, then it had me pick which Google account to use (strange that it wouldn't just choose the one for the Gmail address I entered), then it said I was signed in.
- drew 13y ago
  The gmail case is special, actually. For a few domains (gmail, yahoo, not sure which others) it will fall back to a flow that's more like OAuth. But for unknown domains it sends you an email with a link, and then requires you to create a new account (with a new password) that is persona-specific.
rebelde 13y ago
Here's an example: I just failed to login to Zonino myself. I enter in the Gmail address that I use for registrations and other junk. I get the message: "Accounts don't match. You are currently signed into Google as [my normal Gmail address]. ... Force Google logout?" Forget that. I'm not interested in logging out of Gmail. Logging out of #1, into #2, out of #2 and back into #1 is more work that simple registration. I expect that I'm not the only person with this problem. I hope a solution can be found, because it would be really helpful.
- girvo 13y ago
  Interesting. Persona likely needs work when it comes to multiple Gmail accounts when using the Account Bridging.
- justinhj 13y ago
  Do you get this problem if you use a different browser for the other gmail account?
  - rebelde 13y ago
    No, and that is what I would usually do since I understand how these things work. (IE does come in handy at times.) The point that I am trying to make is that normal users who don't know these tricks can run into this barrier.
    - icebraining 13y ago
      I don't think normal users have multiple Google accounts, though.
      - jtheory 13y ago
        Eh, that depends. All it takes is a personal Gmail account plus working for a company that uses Google Apps.
- kn8 13y ago
slaxman 13y ago
I agree. Though facebook tends to track users, people are so used to see the facebook login button that they feel comfortable with it. Persona, though really good, feels different and makes the me a bit uncomfortable as an end user.
kijin 13y ago
Agreed. Although Persona's technical basis and privacy protections are second to none, the UX is nothing to write home about. It still feels too much like OpenID, and we know what happened to OpenID. Facebook and Twitter can get away with cross-site redirects because they're well known and people trust them. Persona doesn't have that benefit, so it can't get away with the same cumbersome UX. It needs to do better, much better. The market is unfair. Deal with it. If you're in the business of implementing an alternative login system, you should also seriously think about what kind of UX you're competing against. Your ultimate competitor isn't Facebook or Twitter. It's the good old email-and-password login system that everyone is used to. You enter your email address, select a password, and you're in, without ever leaving the signup page! It's even easier if you use a password manager like LastPass. That's what you're competing against, and if your UX has any more steps or redirects than that, you're probably doomed.
- drew 13y ago
  The paradox here is that people are more familiar with the appearance of home-grown-style login systems and are more willing to follow through on those than the novel Persona flow, even though the security characteristics of Persona are stronger. It's a chicken and egg problem, and until someone really big takes the plunge and gets everyone comfortable with this style, anyone implementing it is going to be somewhat of a cost to signups.
  - 500and4 13y ago
    I think you've hit the nail on the proverbial head here.
- whitef0x 13y ago
  OpenID never really made it not just because of their bad UX design but also because they never got major players to push it to the public. Google or Facebook would much rather have you use their service as login credentials as it makes more monetary sense to do so than to hand it over to some non-profit foundation like Mozilla or OpenID. Data = money in this world and everyone wants more money.
zobzu 13y ago
There's 2 issues with persona. 1) users don't already have a personna account setup. They're used to hit their "login with FB/Google" account instead. They don't know that persona is better privacy-wise. So for many, it's just friction. 2) persona login sometimes appears slightly slower
- jmathai 13y ago
  There's an OpenID bridge [1] to make it easier for GMail users to sign in using Persona if they're currently logged into GMail/Yahoo! [2]. I haven't used it but the end goal of Persona is that 3rd party email providers can be their own Persona identity providers. We definitely need something like Persona but I share your concerns WRT friction. Chicken meets egg. [1] http://identity.mozilla.com/post/56526022621/what-is-an-identity-bridge http://identity.mozilla.com/post/56526022621/what-is-an-iden... [2] http://identity.mozilla.com/post/57712756801/persona-makes-signing-in-easy-for-gmail-users http://identity.mozilla.com/post/57712756801/persona-makes-s...
StavrosK 13y ago
Your data (especially the fact that users clearly prefer it) tells me that they're clicking it out of curiosity, to see how they can log in with their email. Unless by "clearly prefer it" you don't mean the initial button click, but the final login?
- drew 13y ago
  You can see how we communicate it on our site if you're curious. Basically it's a modal dialog with four options: * Facebook * Google * Twitter * Email We don't use the persona messaging, and I think people's expectation when they click the 'email' button is that it's going to just be a normal email flow. We don't call it Persona or Browser ID or use any of their assets or messaging, because we didn't think anyone would click on it if we did. But yes, we see a small preference for a button labeled 'email' versus facebook, and a medium preference for either over twitter.
  - StavrosK 13y ago
    I did try it (and signed in) to your site. I'll admit, I knew I was going there for Persona, and "sign in via email" got me curious to click on it, even though I already knew what it was.
EGreg 13y ago
How do you know users clearly prefer it?
- drew 13y ago
  We track clicks on each of the four login methods, and compare it with successful sign in events with each of them. So we know completion rates for each type, plus which types are preferred by users. Nothing fancy, just google analytics events + checking the users table.

by drew 13y ago

StavrosK 13y ago

Why not keep it as a (perhaps less prominent) alternative?

cheshire137 13y ago

Just tried it on your site. It went easily enough. I entered my Gmail address in the Persona form, then it had me pick which Google account to use (strange that it wouldn't just choose the one for the Gmail address I entered), then it said I was signed in.

drew 13y ago
The gmail case is special, actually. For a few domains (gmail, yahoo, not sure which others) it will fall back to a flow that's more like OAuth. But for unknown domains it sends you an email with a link, and then requires you to create a new account (with a new password) that is persona-specific.

rebelde 13y ago

Here's an example: I just failed to login to Zonino myself. I enter in the Gmail address that I use for registrations and other junk. I get the message: "Accounts don't match. You are currently signed into Google as [my normal Gmail address]. ... Force Google logout?" Forget that. I'm not interested in logging out of Gmail. Logging out of #1, into #2, out of #2 and back into #1 is more work that simple registration. I expect that I'm not the only person with this problem. I hope a solution can be found, because it would be really helpful.

girvo 13y ago
Interesting. Persona likely needs work when it comes to multiple Gmail accounts when using the Account Bridging.
justinhj 13y ago
Do you get this problem if you use a different browser for the other gmail account?
- rebelde 13y ago
  No, and that is what I would usually do since I understand how these things work. (IE does come in handy at times.) The point that I am trying to make is that normal users who don't know these tricks can run into this barrier.
  - icebraining 13y ago
    I don't think normal users have multiple Google accounts, though.
    - jtheory 13y ago
      Eh, that depends. All it takes is a personal Gmail account plus working for a company that uses Google Apps.
kn8 13y ago

slaxman 13y ago

I agree. Though facebook tends to track users, people are so used to see the facebook login button that they feel comfortable with it. Persona, though really good, feels different and makes the me a bit uncomfortable as an end user.

kijin 13y ago

Agreed. Although Persona's technical basis and privacy protections are second to none, the UX is nothing to write home about. It still feels too much like OpenID, and we know what happened to OpenID. Facebook and Twitter can get away with cross-site redirects because they're well known and people trust them. Persona doesn't have that benefit, so it can't get away with the same cumbersome UX. It needs to do better, much better. The market is unfair. Deal with it. If you're in the business of implementing an alternative login system, you should also seriously think about what kind of UX you're competing against. Your ultimate competitor isn't Facebook or Twitter. It's the good old email-and-password login system that everyone is used to. You enter your email address, select a password, and you're in, without ever leaving the signup page! It's even easier if you use a password manager like LastPass. That's what you're competing against, and if your UX has any more steps or redirects than that, you're probably doomed.

drew 13y ago
The paradox here is that people are more familiar with the appearance of home-grown-style login systems and are more willing to follow through on those than the novel Persona flow, even though the security characteristics of Persona are stronger. It's a chicken and egg problem, and until someone really big takes the plunge and gets everyone comfortable with this style, anyone implementing it is going to be somewhat of a cost to signups.
- 500and4 13y ago
  I think you've hit the nail on the proverbial head here.
whitef0x 13y ago
OpenID never really made it not just because of their bad UX design but also because they never got major players to push it to the public. Google or Facebook would much rather have you use their service as login credentials as it makes more monetary sense to do so than to hand it over to some non-profit foundation like Mozilla or OpenID. Data = money in this world and everyone wants more money.

zobzu 13y ago

There's 2 issues with persona. 1) users don't already have a personna account setup. They're used to hit their "login with FB/Google" account instead. They don't know that persona is better privacy-wise. So for many, it's just friction. 2) persona login sometimes appears slightly slower

jmathai 13y ago
There's an OpenID bridge [1] to make it easier for GMail users to sign in using Persona if they're currently logged into GMail/Yahoo! [2]. I haven't used it but the end goal of Persona is that 3rd party email providers can be their own Persona identity providers. We definitely need something like Persona but I share your concerns WRT friction. Chicken meets egg. [1] http://identity.mozilla.com/post/56526022621/what-is-an-identity-bridge http://identity.mozilla.com/post/56526022621/what-is-an-iden... [2] http://identity.mozilla.com/post/57712756801/persona-makes-signing-in-easy-for-gmail-users http://identity.mozilla.com/post/57712756801/persona-makes-s...

StavrosK 13y ago

Your data (especially the fact that users clearly prefer it) tells me that they're clicking it out of curiosity, to see how they can log in with their email. Unless by "clearly prefer it" you don't mean the initial button click, but the final login?

drew 13y ago
You can see how we communicate it on our site if you're curious. Basically it's a modal dialog with four options: * Facebook * Google * Twitter * Email We don't use the persona messaging, and I think people's expectation when they click the 'email' button is that it's going to just be a normal email flow. We don't call it Persona or Browser ID or use any of their assets or messaging, because we didn't think anyone would click on it if we did. But yes, we see a small preference for a button labeled 'email' versus facebook, and a medium preference for either over twitter.
- StavrosK 13y ago
  I did try it (and signed in) to your site. I'll admit, I knew I was going there for Persona, and "sign in via email" got me curious to click on it, even though I already knew what it was.

EGreg 13y ago

How do you know users clearly prefer it?

drew 13y ago
We track clicks on each of the four login methods, and compare it with successful sign in events with each of them. So we know completion rates for each type, plus which types are preferred by users. Nothing fancy, just google analytics events + checking the users table.