Persona - Mozilla's decentralized and secure authentication system

https://developer.mozilla.org/en-US/docs/Persona

by 00joe • 14 years ago

194 51 14 years ago

developer.mozilla.org

lukev2• 14 years ago

Other than the benefit of using strong crypto under the hood, I'm not sure what benefits this has over a system like openid. It has about the same level of interactional complexity, and at the additional cost of requiring browser support.

If we're going to have browser support anyway, I'd rather just use standard two-way SSL and put the work into developing better UI and private key distribution systems for it. It's even more secure and has a great user experience once you've set up the key in the browser and authorized it to the site.

StavrosK5• 14 years ago

The benefit is orders of magnitude better usability. I couldn't get users to grok OpenID, this just needs an email and password.

How will my mom log in to an SSL-certificate-requesting site from another computer?

lukev2• 14 years ago

This has pretty much the same end-user experience as OpenID, unless I'm misunderstanding something. The user still has to sign in to the IdP.

shantanubala• 14 years ago

Usability involves more than one target audience: it also has to be easy for developers to integrate.

BrowserID (Persona) took me minutes to implement. On a non-trivial project, it may take a couple hours. The beauty of this is the fact that it still works without built-in browser support. It's designed to be a forwards-compatible API that only becomes more usable with time.

Additionally, email is an excellent way to establish a user's identity, and the fact that it's designed around email makes it easy for a regular person to understand its authentication flow.

The problem with SSL is that it is an all-or-nothing technology. There's a chicken and egg problem: people won't make good UI for it until it's widely used, but people won't use it until it has a good UI. Persona provides an implementation of BrowserID that has a decent UI, and the user experience will only get better with time as more people use it. The chicken/egg problem is solved there, but two-way SSL right now is practically unusable for anyone who isn't very familiar with it (most people). Using an email address is very familiar, though.

StavrosK5• 14 years ago

I've forgone traditional auth in favor of Persona because there are just too many advantages. The user might already have an account, the flow is very good if they don't, it takes literally three minutes to integrate django-browserid (or whatever it's called now) versus skinning quite a few templates for all the login and reset forms, it saves the user from having to remember yet another password, etc etc.

I couldn't be happier with a signin solution. It even complements my legacy solution very well, you can see a demo at http://www.yourpane.com (click "Persona", never mind the email field.)

StavrosK5• 14 years ago

There was a post about this yesterday, but I'll upvote it because it needs all the exposure it can get.

y0ghur7_xxx• 14 years ago

Previous discussion: http://news.ycombinator.com/item?id=4580986

jpxxx• 14 years ago

I can't come up with any reason why this isn't going to be massive. The password problem is the single most frustrating and alienating issue I can think of for normal users.

gambler6• 14 years ago

Two big issues so far: it still uses email for password resets (without alternatives that I know of) and it doesn't work without JavaScript. I hope both of them get addressed.

fmarier4• 14 years ago

The fallback identity provider (at login.persona.org) does use email for password resets, but other identity providers will likely use other mechanisms.

Nux2• 14 years ago

How would I log in from a friend's computer with Persona? How about from an Internet cafe; how safe would it be? Persona looks like something that lock's you into a certain device or at least makes it harder to log in on device's that are not your own.

I'd rather they made OpenID less scarry (to average Joe) instead.

Sami_Lehtinen2• 14 years ago

You really shouldn't login from any non-secure terminal. I have catched even pros doing that mistake with production systems. It's major fail!

Nux2• 14 years ago

Major fail or not a good part of the world does not own their own computer.

fmarier4• 14 years ago

Logging into a different device is not a problem, you just get a different certificate in that device's browser and it allows you to login in the same way.

When you use a computer that's not your own, Persona keeps the session time very small. Of course, when you're done using that computer, you should ideally clear cookies, just like you would if you used OpenID or Facebook on a shared computer.

ozten• 14 years ago

Please try this today. It's one main reason The Times uses it on their Crossword product...

This is safe on a public computer or shared device, if you logout.

Persona also has some UI around public versus personal devices.

eslaught• 14 years ago

Are there any good descriptions for how Persona works? I can find plenty of developer documentation on this site, but I can't seem to find a good, concise description of what parties are involved and what the protocol is, etc.

(Maybe I'm not looking deep enough? Anyway, thanks in advance.)

fmarier4• 14 years ago

This talk gets into how the protocol works without getting too much into the crypto: https://www.youtube.com/watch?v=iZBTc7iEkQY

gambler6• 14 years ago

I just watched the video. So, apparently, the long-term goal is to have email providers to support this and sign user certificates. I'm still not clear on what information a certificate would contain.

More importantly, I really dislike the answer to second question from the audience. Even when the system is fully supported without fallbacks, hacking person's email account will grant the attacker ability to log into all websites as the victim?

I already am quite concerned with how much control over everyone's identities services like Gmail have. If I understand it correctly, Persona will give them more direct control over user's identities. It's only decentralized in a sense that different email providers will be able to implement it separately, and verify identities of their users.

I hope I'm missing something from the big picture here.

abrichr• 14 years ago

https://developer.mozilla.org/en-US/docs/Persona/Protocol_Ov...

natch• 14 years ago

Authentication mechanisms and they way they are implemented can have bleedover into the ability of a user to maintain control of their anonymity and privacy.

Has there been any writeup that explains the potential impact of Persona on privacy? Not just the impact when used as intended, but also any unintended effects?

callahad3• 14 years ago

I'm not aware of any standalone articles, but something of that nature would be really fantastic. Such an article would probably be best if written by someone outside of the Persona team.

ygjb3• 14 years ago

Just a further comment, anyone interested in writing such an analysis or document should contact us with any questions!

Flimm5• 14 years ago

There's an hour long video discussing the measures taken to protect the user's privacy, given by Ben Adida, one of the developers. It's 12 months old, but I believe the protocol hasn't changed enough to make the information out of date.

https://www.youtube.com/watch?v=QDSh3osE4GQ

Also, see this blog post:

http://identity.mozilla.com/post/7899984443/privacy-and-brow...

wgd• 14 years ago

I really like the overall result of Persona when used for logging into a web site, but has anyone come up with a good way of integrating Persona login with mobile apps or APIs?

I suppose mobile apps would ideally use some sort of Persona login service provided by the underlying OS, and until such a thing exists I guess an app could reimplement all the user-agent logic and load the user's login page in a webview. But I have no idea how at all I would go about designing an API for a website which uses Persona for logins.

callahad3• 14 years ago

We don't have a good path for native apps, yet. There have been a few experiments using Persona in native iOS (Pancake) and Android (Soup) environments, and it apparently works great in PhoneGap apps, if you use the ChildBrowser plugin.

The bug to watch is this one: https://github.com/mozilla/browserid/issues/2034 supporting environments without popups will clear the way for good native SDKs.

flashmob• 14 years ago

Does persona reveal your email address to the website that you login to?

OpenID usually doesn't reveal your email address.

For example, when logging in to Google via OpenID, google will only send back a unique identifier that means 'yes, the user has a google account' but no other personal information. Yahoo does the same.

(of course, it's possible to use OpenID extensions to get a user's email at their discretion)

Does persona work in the same way?

Flimm5• 14 years ago

Yes, Persona does reveal your email address to the website you log in to. This is considered a feature, because:

1. It prevents lock-in to Persona. (If you want to migrate away from Persona, you can just send the users an email and introduce the new authentication mechanism.)

2. Most websites will need some way to contact the user, and will ask for their email address any way.

3. Users understand the concept of email addresses as identifiers.

If you care about keeping your email address private, you can always use the features your email provider offers such as forwarding email addresses.

vivab0rg• 14 years ago

Just integrated it on a personal Padrino project. Beautifully simple user and developer-side. Congratulations and thanks Mozilla!

Persona - Mozilla's decentralized and secure authentication system

Related Stories