I personally feel the pain point of password/identity management across different websites, and I'm using LastPass to help. While LastPass's browser integration is great, its UX is... lacking. Mozilla's strategy to associate Firefox browser with identity is IMO awesome and the first sign that it's pioneering vs reacting to Chrome (before this news, I've always viewed Firefox as Chrome's successful but still little br…
Can you be more specific as to how you find the UX lacking?
Have been messing around with BrowserID since it first went public last year (with a node.js backend) and I love it. Its so much more straightforward to implement than oauth and openid, and the fact that it's tied to your email address is perfect. I'm definitely going to be using it as my primary auth system going forward. Great job Mozilla!
I personally feel the pain point of password/identity management across different websites, and I'm using LastPass to help. While LastPass's browser integration is great, its UX is... lacking. Mozilla's strategy to associate Firefox browser with identity is IMO awesome and the first sign that it's pioneering vs reacting to Chrome (before this news, I've always viewed Firefox as Chrome's successful but still little br…
Can you be more specific as to how you find the UX lacking? Getting UX right is a priority for Persona.
I was referring to LastPass's Chrome extension specifically, not Persona's UX. Sorry for the confusion.
Right, but the email providers are only authenticating you to Persona. As far as the websites using Persona are concerned, it's persona.org that authenticates you. And the appeal that Mozilla is pushing is definitely better security (as well as a distributed security authentication versus one for-profit authority - I definitely trust Mozilla MUCH more than Facebook or twitter, but it's still a central authority). You…
As a website you can do local verification of the log in assertion. Mozilla hosts a verifier as a convenience, but you don't have to use it.
But the assertion only gets sent if the user logs in to persona first (with their email and persona password)
I personally feel the pain point of password/identity management across different websites, and I'm using LastPass to help. While LastPass's browser integration is great, its UX is... lacking. Mozilla's strategy to associate Firefox browser with identity is IMO awesome and the first sign that it's pioneering vs reacting to Chrome (before this news, I've always viewed Firefox as Chrome's successful but still little br…
Persona doesn't require any browser integration. It works in all browsers that implement local storage. So it works via modern Javascript.
I'm sure Firefox will release a Firefox plugin that will complement the basic service of identification. Imagine a plugin that lists all the websites you can authenticate with Persona. Or what if you had multiple personas, the firefox plugin can help you manage the selection of personas. Eventually, it'd become baked into Firefox, giving users that sense of it fundamentally "safer" than other browsers. Sure, this is all speculation, but it's a good marketing strategy on Mozilla's end and the start of gaining back the average consumer market share.
This seems to be a nice solution if you are on your own home/work computer and have your email open. They didn't really explain much on HOW it works but the problem I'm seeing is that if I am at a public computer and want to login I have to log in to my email account first and click on the persona link. I guess the benefit here is that I only need to remember 1 password (my email address password) but my email passwo…
That's not really how it works. You verify your email address once, and after that you can just log in with your address and password. You don't have to click on an email link every single time you log in.
Persona, the protocol, doesn't actually rely on your email account's password. It uses the domain from your email account to figure out how to authenticate you; if you want to use some other way than via your email, that's fine.
The password that I create when I setup persona is for what exactly? It doesn't seem to be used at all after the creation a persona.
If you log out, that's the password you'll use to log in again. The login session is good for a while so you can continue to login with already-authenticated identities (and you can have as many as you want) on persona-enabled sites.
Persona doesn't require any browser integration. It works in all browsers that implement local storage. So it works via modern Javascript.
I'm sure Firefox will release a Firefox plugin that will complement the basic service of identification. Imagine a plugin that lists all the websites you can authenticate with Persona. Or what if you had multiple personas, the firefox plugin can help you manage the selection of personas. Eventually, it'd become baked into Firefox, giving users that sense of it fundamentally "safer" than other browsers. Sure, this is…
Hi, John, you have some cool ideas there! Hope to see you hacking on Persona. As a member of the team, I just want to clarify that this is not an effort to make firefox alone more secure; it's an effort to make the web more secure. Any browser vendor can implement the protocol, natively or in a plugin, and we hope other browsers will. Same for identity providers. The spec and code are all open-source: https://github.com/mozilla/browserid So Mozilla's strategy remains the same: Put the users of the internet first. That's why we made this.
how does it work with multiple users using the same browser?
When you click the "Sign in with Persona" button on a website, the dialog that pops up has a "This is not me" button which logs out the current user and allows you to login with a different email.
I don't know if it's appropriate but can we list some of websites where one can login through browserID? I 'm a big fan of browserID, and would gladly beta test your integration.
Sure thing. In addition to many of Mozilla's own sites, here are some examples: