Mozilla Identity Blog

Disclaimer: my opinion is entirely MY OWN OPINION and does not reflect Mozilla's opinion or anyone I have worked with in the past. I also acknowledge my lack of deep understanding/insight of any sort but just a tiny bit of what I think I know, so feel free to correct me.

I agree with many of your points because they are in fact excellent arguments. Trust can mean various of things. But in this context, trusting Mozilla is merely trusting Mozilla based on its reputation. Mozilla does not log your password and does not sell you to an advertizing agency so your new shiny Fx Account is really to be used for Mozilla service. At least as far as we know at this point. Mozilla was named #1 most trusted organization [1] but that doesn't mean we should say Mozilla is more trustworthy than Google without considering the context in which the trust is placed in.

The first thing I want to echo is expectation. We expect so and so to do such job and deliver such promises. We expect that when we first sign up the password I pass to Firefox Account and Google Account, my password is hashed and salted with strong hashing algorithm. We expect Mozilla engineers and Google engineers to be honest and professional, so they won't be use MD5 or SHA1 to keep our passwords. But are they? We have to put a bet on Mozilla.

Almost all the Mozilla projects are open-source, meaning they exist somewhere on mozilla-central or on Github. But we can't verify that a server is actually running the code the…

Sent some feelers out to devs I respect. Verdict is mostly negative on Persona.

Seems like Mozilla is merely providing bare bones support for Persona these days, and has stopped funding it: http://identity.mozilla.com/

Further, and this is the real nail in the coffin for me, it seems like if you wish to change your email address or lose access to it, there's no way to migrate all accounts at once. It's up to the implementor to support that: https://developer.mozilla.org/en-US/Persona/The_implementor_s_guide/Enabling_users_to_change_their_email_address

Fun note: Until recently, Email wasn't even required to sign up for GS. A Hacker News user pointed out that without this there's no way to let a user reset their password, so I made it required (though there's still no actual way to reset your password yet. Eeps!) https://news.ycombinator.com/item?id=8521505

Well Hammer-Lahav calls it "the biggest professional disappointment of my career" on his blog[1] so I guess he's aware of that aspect (more[2]).

The Mozilla Foundation's Persona[3] looks to be further along in terms of code and in terms of other people using it[4], differences with OpenID are partially described here[5]. Regardless of quality I think someone flying solo is going to have a hard time getting ahead of Persona at this point.

[1] http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/

[2] http://hueniverse.com/2012/07/on-leaving-oauth/

[3] http://identity.mozilla.com/post/32395255498/announcing-the-first-beta-release-of-persona

[4] http://identity.mozilla.com/post/31008721633/application-and-platform-integration-of-persona

[5] http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid

Er... "they" have also published the full source code involved (at https://github.com/mozilla/browserid ) and a privacy policy at http://www.mozilla.org/en-US/persona/privacy-policy/ that you can compare to said source code as desired, if you're using Mozilla's identity provider.

As far as the architecture of the overall thing, there are also http://identity.mozilla.com/post/7899984443/privacy-and-browserid and http://identity.mozilla.com/post/11145921163/browserid-design-for-privacy and a technical specification at https://github.com/mozilla/id-specs/blob/prod/browserid/index.md that describes the exact data flow involved.

And if you read those, it should become pretty clear _why_ this is better for privacy than the FB or Google login systems. For one thing, the identity provider is never told that you're logging in.

I believe that a native implementation has been on their plans from the start, but I haven't heard much about it lately. Here's some mockups:

http://people.mozilla.com/%7Efaaborg/files/projects/firefoxAccount/index.html

There's also some work on integrating existing e-mail providers, so you can get instant identities:

http://identity.mozilla.com/post/17207734786/id-provider-support-now-live-on-browserid

This is probably the web-thing I'm most excited about today, even though the development is kinda slow. I really want to implement it as a sole identity provider on my websites some day.

EDIT: I also began writing a Safari extension that would work like the mockup above, but gave up halfway since it was too convoluted and totally insecure... maybe I should try writing a SIMBL plugin or something like that.

Ben Adida, one of the developers, wrote a post on the subject here: http://identity.mozilla.com/post/7669886219/how-browserid-differs-from-openid

In short, three big differences:

1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them.

2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal for Mozilla and for me.

3. Browser integration: The APIs are currently implemented with a javascript shim, but the browser can step in (either via native support or an extension) to provide new, exciting types of authentication -- dongles, certificates, interpretive dance via a kinect, etc.