Comment by callahad | Hacker News Reader

Comment by callahad | Hacker News Reader

Parent Full thread

Hi, Persona dev here.

We want to do better: we want to get rid of the Persona servers altogether. As tlocke said, Persona is designed to let you choose who you trust, and anything that requires centralization is considered a bug.

There are 4 points of temporary centralization, each of which can be replaced independently:

1. The JS polyfill. Until we stabilize the API, we ask that you link directly to login.persona.org/include.js

2. The persona.org interface. Once browsers have native support for Persona, that will supersede both the polyfill and the persona.org interface. This is all based on what Mike Hanson called Locally Isolated Feature Domains (LIFD): http://www.open-mike.org/entry/lifding-the-web

3. The Fallback IdP. If your email provider doesn't support Persona, Mozilla will certify your identity after you click a confirmation link sent to your email address. If your email provider does support Persona, it automatically supplants Mozilla's fallback.

4. The Hosted Verifier. Until we stabilize the data formats, we recommend that sites POST identity assertions to verifier.login.persona.org/verify for verification. The assertions necessarily contain your email address and the site you're logging into. We want this to go away soon, and François Marier has suggested a pretty slick way to get us there. Until then, we've got a strong privacy policy in place and we limit the data we log. I believe Ben Adida is going to comment more on that shortly.

If you're interested in getting involved, drop me a line and I'd be happy to help you get started.

Thanks for commenting - it's good to hear that you are aware of the issues and that Persona is moving in the right direction.

Also: Good job on Persona - you guys deserve praise - as I said in the blog post, I'm very excited about Persona, primarily because I see it as a huge user experience improvement over the current normal sign-in flow.

To clarify more: Persona is not "moving in this direction," it has always been designed as a completely decentralized identity solution. The Persona server is just a boostrap to get it started so here's what you can do: create as many identity providers as you can! Seriously, put one in every country.

> Mozilla will certify your identity after you click a confirmation link sent to your email address.

Asking email address for sign-up is perhaps important, but I'm wondering why can't it be removed completely from the process? It is a piece of friction, and potentially identifying as OP puts it in his post?

Can't we be just done with the requirement of email address? Let early users, especially those who inspire the rest of the bell curve, remember their persona id with some personal questions that the user may so choose.

Get rid of anything that can be gotten rid of.

Email addresses have certain advantages:

- Most everyone on the 'Net has one.

- Most everyone remembers their email address (but they might not remember what usernames they used for which websites).

- Email addresses are unique, so when a user signs up for Persona, they don't have to go through that time-wasting "this username is taken, try this one instead" process.

- Email addresses make it easy to recover forgotten passwords.

So - while I see you point - I think that email addresses are the best option.

I mostly agree. Now this may be a bit difficult to explain, but all the logic in the points above sort of align towards the intent of achieving mass adoption. But I am afraid that mass adoption is not going to happen just like that. And it is certainly not going to depend on the fact that everyone uses email.

Let's look at an ordinary user first. An ordinary user doesn't half understand the subject of privacy. He/she is rather more interested in sharing his/her best looking picture on Facebook. Or worried about landing a good job with a nice new email with all the strengths. Which is the cool app, what is the next device he can show off etc.

Why would Persona matter to such a user? A type that is majority and we've counted them all in the statement 'everyone on the 'Net has one'. So this is more like opening an end of a small pipe to the atmosphere thinking that all the air will pass through it.

- Most everyone on the 'Net has one.

Yes. But it doesn't provide any motivation for people to go and sign-up for Persona. Hence email registration only adds to friction.

- Most everyone remembers their email address (but they might not remember what usernames they used for which websites).

This one is real. Since Persona is about, well, persona it is more likely to remain etched in the memory of early adopters (ignore mass adoption for a later stage) provided it is done right, kept right etc. Mozilla is an amazing and capable organization so it should experiment more given that the project itself is an ambitious experiment.

- Email addresses are unique, so when a user signs up for Persona, they don't have to go through that time-wasting "this username is taken, try this one instead" process.

Dumb users are dumb enough to try signing up with the same email id again. I am not very sure about Persona's positioning w.r.t same person having multiple email ids?

- Email addresses make it easy to recover forgotten passwords.

Agreed. However, Hacker News is a great example of why both email id and password recovery are immaterial for a product to be successful (Kudos PG!). I do agree with the simplicity of recovering forgotten password through email, but this is certainly not a show-stopper at this stage.

I don't think Persona is pitched for the tech-savvy. On the contrary, I think Persona offers a huge advantage for normal users: You can do one-click sign-ups and log-ins for new websites (provided that you've already signed up for Persona and that you've checked the "save my session" button or whatever it's called).

Another advantage is that you don't have to waste time validating your email address when you sign up for a new website. Persona has already validated your email.

Email addresses aren't exactly unique per-person though. I frequently forget which email I've used on a website, but rarely the username (except for ones where I don't get to choose)

It would seem that developers receiving verified email addresses of users was deemed more important than privacy and supporting scenarios where email addresses aren't required to establish accounts :( IMO, a hard requirement should have been that email addresses are optional and Mozilla should go back to the drawing board for that reason alone. The "it technically doesn't have to be a working email address if the identity provider doesn't want it to be" argument isn't enough.

IMO, another hard requirement should have been that it involve no other parties than the user and the site where they are establishing an account and that approach should be easy for everyone. Major email providers are compromised and therefore email providers should be designed out of the process. Asking average users to setup and maintain their own identity provider is asking too much.

>The "it technically doesn't have to be a working email address if the identity provider doesn't want it to be" argument isn't enough.

Err, even though it does literally everything you want?

>Asking average users to setup and maintain their own identity provider is asking too much.

So you want a way to prove identity across multiple sites avoids needing any of a central provider, third party providers, and self-hosted providers? Good luck with that...

To your first point, who is the identity provider? In practice, it will almost always be 1) a third party, and 2) an email provider that is unlikely to deviate from the "must be a functional email address" approach. So in order to benefit from that support and stay away from third party identity providers you must run your own identity provider.

To your second point, the problem is that self-hosting an identity provider requires a domain name, Internet accessible HTTPS server, and a server certificate that is trusted per Mozzila's cert bundle. For average users to benefit they'd have to setup their own server on their own premises or turn to a third-party for [identity] hosting service. For at least baseline requirement purposes, the device the user is using should be the only device they need to carryout their account creations and logins. I haven't thought it through, but maybe there could be an @localhost format where the browser itself acts as an identity provider.

They're ubiquitous. They're an easy unique identifier. And they're free, as in cheap. Meaning they don't have to have any sort of relevant identity. I have dozens of email address and only two that are related to my real "identity".

If you want to get rid of the IdP right now (and you have your own domain), you can use the plug-and-play MVP IdP I wrote: https://persowna.net

Is there something I can do with my domain to "enable" Persona, like SPF [0] or SSH fingerprints in DNS records? [1]

[0]: https://en.wikipedia.org/wiki/Sender_Policy_Framework

[1]: https://tools.ietf.org/html/rfc4255

I think persona is extremely useful. The only addition I'd like is for a similar service that allows you to query an identity provider for a public key for a user.

Reply on news.ycombinator.com