About Mozilla Persona

Or why " Mozilla Persona do not solve OpenId Problems"
By chance I'm working on authentication stuff these days. A SCrypt Hasher for django and some Spring Security SSO integrations.
I'm also watching pycon videos and I came across "Beyond Passwords: Secure Authentication with Mozilla Persona" by Dan Callahan.
The presentation is actually very good but to me, an SSO and OpenId enthusiast, clearly reflects missing points of the Persona initiative.

1. Persona has better UX than OpenId (process is simpler and clearer )
2. Easy to implement 

But

1. Using email as credential is a BAD BAD idea: What if I subscribe a service  ( let's say "Mozilla developer center" )  with my professional email and I got suddenly fired by my employer upon unfair conversation at PyCon. I lost control on my profile on that site. OpenId has an elegant solution for that. The meta-tags.
2. It still lacks of personal data exchange: Dan Callahan says that they are working on that, waiting for developer feedback... and shows how, upon first time usage on a site you have "just to fill your name, surname , gender... super boring. This is why the whole "social signin" came out. The problem here is that "Identity services" never took off.
3. OpenId is easy to integrate too... if you have a library for your language / framework of choice ( Rails, Django, Flask, Spring have it) 
4. It is not as distributed as is meant to be: you still need mozilla for js ( why is explained in the video) for the "proxy thing" (mozilla) for email providers that do not support persona. I didn't get how signed credential renewal works ( since it is said that there is an expiration) but with only one persona per site ( different personas are different accounts right?) who does it mitigate third party services outrages ( or shutdowns :-)  )
5. It is actually a lock in: with your email provider and... mozilla in a way.
6. No email provider will ever support it: Google, Microsoft, Facebook ( yes now Facebook is  also an email provider) are active in the Identity management business and will not probably favor an initiative from a competitor in the browser market.
7. [Almost]No browser (except Firefox) will ever support it: see point n.6

The main fact here is that Persona do not solve any of the OpenId problem except better UX ( well... it wasn't a big deal) but still I think my Mom, my average Gym friend etc.. wouldn't understand what Persona is, how it works. They know Facebook and Twitter.. that's the internet for them ( yeah sad thing indeed) and I would not trade this better UX with the actual OpenId  ecosystem. Up to now it is just another sign in button among the others. Anyway good luck Persona!

On Mozilla BrowserId

Some weeks ago I read about new Mozilla's BrowserId initaitive. My opinion in two words... bad idea. Disclaimer: I'm an OpenId fan boy These are my concerns about BrowserId


Momentum: it has taken years for OpenId to gain som traction in both developer and "non hacker" internet users. And only when main social networks and service providers(Google , Facebook) has became also OpenId providers people started using it. Now, with a new "standard" (note the quotes) we will see fragmentation in Internet SSO panorama. If "Facebook connect" and "Sign in with Twitter" weren't bad enought a new player on the field will make things worst. For users (see below) and for developers who has to support Yet Another Sign In Method.


Subscription workflow: this is a simplified version of BrowserId subscription workflow

1. You log into e.g. gmail. 
2. Your browser generates a keypair and sends the public key to gmail. 
3. Gmail signs your public key and sends your browser a certificate saying "this key is owned by whoever@gmail.com". 
4. You click "sign in" on some site (e.g. Hacker News) that uses BrowserID. 
5. Your browser sends Hacker News an message saying "my user is whoever@gmail.com", that is signed with the private key generated in step 2. 
6. Hacker News looks at the "gmail.com", grabs gmail's public key (the one that signed your public key in step 3) and verifies the signatures. 

Full descritpion coun be found here Now the two main problems here are that this workflow is over too complicated and you are locked in with your email service provider. OpenId has an elegant solution for this.


As a final note I didn't find a clear answer on the fact that BrowserId would require also a browser feature ( I suppose so ) and if it would be ever supported by someone else other than Firefox.