Mozilla Persona was the best of the authentication protocols :(
1) The NASCAR problem. Arrive at a page for a site you signed up for with OpenID and be totes confused: which "openId" did I use for this site?
2) The privacy leak: If you used your Google OpenID, now Google knows that you logged into someotherplace.com with your "openid"
3) The ID problem. Wait, what? Yeah, like, how does someone keep track of which "openid" ID is "me".
The final problem is that not many people will write a full implementation of it other than the big players like mozilla itself or Google or Microsoft. And the latter two don't have a ton of incentive to do so.
The odd thing is that I didn't even know it existed until this whole conversation about Google dropping OpenID came up...and I use Firefox as my browser across all my devices, I use sync, I use Thunderbird, I follow the Firefox OS development with interest, and yet, I had no idea Persona was a thing.
I've always been uncomfortable with Google and Facebook being my "identity" provider, and I've been equally uncomfortable with the fact that they would happily provide those authentication services but won't accept them (i.e. I can login to thousands of services using my Google or Facebook account, but I can't login to Google or Facebook with any other service account). I simply don't like Google and Facebook owning my online life, but the convenience of it often trumps the ethical and privacy implications. I have, thus far, avoided integrating Google or Facebook logins on my sites because of the ethical implications, but I hate making my users keep up with passwords and usernames.
Why aren't more websites supporting Persona?
For my part, I plan to integrate Persona into the next version of my company website launching early this year, as well as our wiki and blogs. I may even try to figure out how to fit it into our products, somehow.
I found the following, seemingly maintained, extensions for Persona support in the apps I use for the websites I maintain:
https://www.drupal.org/project/persona
https://github.com/tmarble/nongrata.
It was actually a snap to implement. I did most of the coding at it took me maybe a few hours total and I NO idea what I was doing at the time. So if you want to USE Persona or integrate with Mozilla's implementation, there's nothing stopping you.
Writing the full stack of a Persona implementation is a many week to several month job for a half a dozen member team not only for development but from an infosec point of view.
It allows all your users to log in to Persona-supporting sites with their @yourdomain.com address, bypassing the bridge, and supports various nifty features like catch-alls, two-factor auth, etc.
Push for it. Implement it anyway. Work on it and write to Mozilla giving your thoughts about it. Whenever authentication is mentioned on HN, write about Persona and why it's still relevant.
That's the best you and I can do. Best of luck, we'll need it...
Come up with a way to market it that makes sense to your mother in under 10 seconds. The "why the heck is this better than the Facebook button" is something Mozilla marketing couldn't crack, and until that gets solved you can't get the "who the heck is Bruce Schneier" crowd to switch.
The final problem is that not many people will write a full implementation of
it other than the big players like mozilla itself or Google or Microsoft.
And the latter two don't have a ton of incentive to do so.
On the client side, there's a glut of OpenID Connect implementations for various languages, or you could outsource it to the likes of mod_auth_openidc for Apache, or a node.js proxy using Passport, or whatever you'd like.
Once a user is authenticated, which can be handled by the libraries just fine, the rest of the data model is simply OAuth2 and a key/value list of claims about the user. I'm not sure how anything is pushing smaller players out, so long as those players are willing to use MIT (or equivalent) licensed code?
1. https://github.com/orf/simple/blob/master/simple/app.py#L381
Depending on what you are working on, you can use it how it is right now. It's nicely integrated into gmail, it works good enough for other mail providers. There are modules for probably every big web programming language and for many frameworks, most blogsoftware should have a plugin for it.
I use it in all my personal projects and had no issue with persona itself. The one issue was that the sinatra gem is unmaintained, but there is a fork that works fine.
Logic being if someone controls your email account already, it doesn't matter that you have two-factor auth, they can shut it off because they control your account. A lot people using two factor auth with their Google account have been hacked exactly this way.
Can you explain this a little more? I don't think I understand, because to me it sounds like you're saying, "once your account is hacked, two factor authentication won't help because your account has been hacked, so the adversary can disable two factor authentication". Don't major changes to accounts like that sometimes require re-authenticating with all required factors? I need to do this if I want to add a bill pay recipient to my bank account even if I'm already logged in.
http://www.makeuseof.com/tag/two-factor-authentication-hacke...