Open Letter to Mozilla: Bring Back Persona

Facebook’s “Anonymous Login” doesn’t protect you in any way from Facebook, it’s for hiding information Facebook owns about your life from other websites. So it doesn’t help with this:

>The basic, accurate information you receive from the FB SDK really helps salespeople identify qualified leads for trial-to-paid conversions; the info also can be used to tell you what other websites people visit or software they use. This really helps make sales and improve your software in a way that seems generally net positive for consumers and producers.

but does nothing at all to protect your privacy.

> And yet it's hardly adopted anywhere.

That’s because it’s Public Relations. Just like their TOR gateway. Just like Zuckerberg’s LLC “charity.” Just like everything else they do[1].

“Steps in the right direction” is the signature move of modern corporate PR.

[1] http://thehill.com/policy/cybersecurity/258060-advocate-accu...

> It should've been supported directly within the Firefox chrome ASAP.

That could have been fixed, and could still be fixed.

> It had branding different than the site you logged in to and was in a popup[1].

That could have been fixed, and could still be fixed.

> It took the name of another Firefox feature that users already knew about.

That could have been fixed, and could still be fixed really, but it's pointless now.

> Because the team was experimenting fast, the code quality of the service was such that outside contribution to it (or even cross-team contribution internally) was hard to impossible.

That could have been fixed, and could still be fixed.

> We had enough time to do these things, but we didn't. The team accomplished something really amazing, but it wasn't enough, and most importantly, putting more effort into what already existed was not going to work. This idea that Mozilla can just turn around and throw effort at Persona and make it win now is, IMO, wrong.

Why wouldn't it make it work? Persona was only alive for 2 years. It saw slow adoption, in part due to usability issues. If you fix the usability issues and give it more time, why wouldn't it be more successful? The issues holding it back were not fundamental. In fact, the fundamental design of Persona was sound and worked very well.

Now, yes, merely fixing things and making the project supported again won't make it more successful overnight. It may need rebranding, it may need a lot of promotion, strategic partnerships, etc. But to declare it completely dead and waste effort on recreating what you already have is silly and counterproductive.

Persona already has many sites - and people! - using it. It already has some (limited) brand recognition. It already has a solid protocol and design, a working codebase, a hosted service that is usable.

The hypothetical successor to Persona? It has none of this. A hypothetical new approach? It has none of this. Could that change? Sure, but you're still starting from zero, and you have to re-do everything.

But why start again when what you had wasn't fundamentally broken?

> We need a successor or a new project.

Why? What could a successor or new project bring that Persona couldn't?

From what I read (very very briefly), the spec is similar to what OpenID was, in that anyone who runs a web server can become an authentication provider. Ideally there'd be a distributed-hash-table type web-of-trust so its semi-centralized (i.e. somewhat like PGP or BGP routing tables where you peer with people you trust).

Now that 1st party browser certificates are available so you get that Trusty-Green-Lock(tm) on all browsers, geeks can theoretically run their own identity service based on some sort of combination of these technologies. (Ideally with the long term outcome solving the "Why Johnny can't have Crypto" problem, maybe using a cell phone app as an RSA SecurID type dongle.) This also has the benefit of letting you authenticate against your bud John's Identity Server, rather than Go-fuck-yourself-Fred's (you'd need token negotiation in there somehow though).

Someone smarter than me (DJB where are you?) should piece this together, release it as open source for the end-user, and fund it via expensive Exchange module integration.

You misunderstand how Persona works. You can't log in with Facebook or Twitter, because they don't provide your email address. You can log in with an email address, and the email provider doesn't know what sites you're logging in to.

Try https://pastery.net, log in there. If you have a Gmail account, you'll just click "accept" and you're in.

Persona seemed like the right identity product for its time, but technology has moved on in the years since. We now have blockchains: shared, publicly-writable databases that are perfect for hosting identities that users fully control. Figuring out decentralized identity is part of my day job, and if it's something you're interested in building or talking about, email me: niran@niran.org.