In principle, Persona is great. Not storing passwords is awesome, a non-FB/Google/Twitter identity option is important.
I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site (http://www.sixquestions.co) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our next-worst performer (Twitter), and half the rate of our best performer (Facebook). For all the concerns people have with authorizing Facebook/Twitter access, that is (in my view) offset by the alien-ness of Persona's login flow. We've heard from lots of users that logging in with Persona is unusual and they thought they were doing something wrong because they'd never seen anything like that.
So, as much as I believe in Persona, I'm about to deploy a change that removes it entirely. It adds a lot of surface area to our testing and future development, but if it means we lose fewer users in their signup flow, it will be worth it.
Here's an example: I just failed to login to Zonino myself.
I enter in the Gmail address that I use for registrations and other junk. I get the message: "Accounts don't match. You are currently signed into Google as [my normal Gmail address]. ... Force Google logout?" Forget that. I'm not interested in logging out of Gmail. Logging out of #1, into #2, out of #2 and back into #1 is more work that simple registration. I expect that I'm not the only person with this problem. I hope a solution can be found, because it would be really helpful.
Agreed. Although Persona's technical basis and privacy protections are second to none, the UX is nothing to write home about. It still feels too much like OpenID, and we know what happened to OpenID. Facebook and Twitter can get away with cross-site redirects because they're well known and people trust them. Persona doesn't have that benefit, so it can't get away with the same cumbersome UX. It needs to do better, much better. The market is unfair. Deal with it.
If you're in the business of implementing an alternative login system, you should also seriously think about what kind of UX you're competing against. Your ultimate competitor isn't Facebook or Twitter. It's the good old email-and-password login system that everyone is used to. You enter your email address, select a password, and you're in, without ever leaving the signup page! It's even easier if you use a password manager like LastPass. That's what you're competing against, and if your UX has any more steps or redirects than that, you're probably doomed.
1) users don't already have a personna account setup. They're used to hit their "login with FB/Google" account instead. They don't know that persona is better privacy-wise. So for many, it's just friction.
2) persona login sometimes appears slightly slower
Your data (especially the fact that users clearly prefer it) tells me that they're clicking it out of curiosity, to see how they can log in with their email.
Unless by "clearly prefer it" you don't mean the initial button click, but the final login?
Just tried it on your site. It went easily enough. I entered my Gmail address in the Persona form, then it had me pick which Google account to use (strange that it wouldn't just choose the one for the Gmail address I entered), then it said I was signed in.
I agree. Though facebook tends to track users, people are so used to see the facebook login button that they feel comfortable with it. Persona, though really good, feels different and makes the me a bit uncomfortable as an end user.
Persona is an elegant, powerful idea that is 100% in the users interest. I dearly want to see it gain traction. Kudos for disseminating your enthusiasm.
(I know Apache may not be that popular with the HN crowd anymore, but I don't currently have the time to dive into nginx and do the same for it. Nevertheless, if anyone wants to do that, I'd be happy to answer questions and provide pointers into the Apache code.)
I completely agree. I was just thinking about this earlier today, there was lots of hype last year about it but it seems to have died down, and the project seems to have stalled.
I really want to see it pick up steam and succeed, and I think the number one priority now is to implement plugins for major browsers. I hope the team picks up development again.
Not elegant at all, but the best option we have supported by some powerful force (Mozilla) that can push it onto users by embedding it into their browser.
Personally, I view Persona as just an awkward kludge that, while improves some important things, also does certain harm by pushing us one step away from making third parties mere notaries of one's identity, not its very providers.
Because it's me who's the source of my identity, nor my email provider nor domain registrar.
I've been using Persona as my sole login mechanism on http://letscodejavascript.com for over a year. I want to love it, but I don't.
The goals behind Persona are excellent: strong privacy protection and relieving website operators of cumbersome and error-prone authentication management. I love the idea. It's why I implemented Persona on my site.
The execution of Persona has been a bit wobbly. Logins are critical infrastructure and it doesn't feel like Mozilla is approaching Persona from that perspective. The team has been fantastic (thanks, callahad) but when things go wrong, it can take a long time for them to get resolved. Meanwhile, I'm left scrambling for a workaround.
An example: when the Yahoo bridge was implemented, it broke Persona for everyone who used a Yahoo alias [1]. A nasty break that returned a non-helpful error message. Something that serious merits an immediate rollback, in my opinion--but instead, it was left in place for several weeks until a interim solution was rolled out. The interim solution has some fairly serious UX problems, but the full solution has been open for 10 months now [2].
I want to love Persona, and I can't really afford the time required to do my own authentication, but it scares me that I'm so dependent on it.
Persona vouches for you when you sign in. Really neat, no more password leaking.
The important thing here is that as Persona protocol (BrowserID)'s creator, Mozilla really really wants someone else (potentially YOU the user) to run the Identity Bridge. Currently Mozilla does this for non-Gmail and non-Yahoo users too boost adoption. So when you sign up you are asked to give a new password on sign up. If you are paranoid, you should of course give a new password instead the one you use for your email (which I assume may be reused for multiple accounts...)
But being able to authenticate yourself on your own is what makes Persona useful.
edit: at realworld crypto, this was given as a talk. This is Google's possible direction.
Biggest problem I have with Persona is one of it's main selling points; if you log in to one place you're logged into all the places. That may sound great, but it really isn't. It means that you can log out of a site because you don't want people sharing your machine to have access to it. You then log into a different, lower-security site. Instantly that first site is accessible again.
I wrote a whole thing on Persona a while back ( http://lepidllama.net/blog/trying-out-mozilla-persona-browse... ) but that ended up being the killer for me. It might be fine for activities like posting comments on a blog, but any site which stores or presents some aspect of who am I to the world needs to be a bit more secure than that!
I guess this is just a sign that I am getting crotchety, but headlines like this just anger me:
Why we love/like X, And why you should, too
My immediate reaction is always something along the lines of, don't presume to tell me why I should like anything. Tell me why you like it, and be done with it.
But it also proof that being awesome not only is not good enough to be successful, but simply doesn't matter. The user is not interested in a solution that is awesome, but one that doesn't scare him. And a big ugly third-party popup is as scary as stuff on the web gets these days.
EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different identities (username/password combinations) are encouraged currently is because providers can't be trusted with the secret of your password.
Last time I looked into persona, it was essentially unusable for my usage - there's no reasonable way to use a different email address to sign up for every site. I like to know who leaked my email address when I start getting spammed.
That's one of the things I needed too, so I built this (sorry for posting it so much here): https://www.persowna.net/
You can add your domain as a catch-all, so you can authenticate with [email protected] and it will use a single account to authenticate. Services will still see your custom email address, but you only need one password.
It's funny that the few entities we'd be more inclined to trust are the ones that go out of their way to make sure we don't have to trust them: Firefox Sync does client-side encryption so you don't have to trust the server, Persona does authentication via an identity provider so you don't have to trust persona.org...
I don't get why persona needs its own branding... Nobody knows what persona is. It should say login with Firefox. Did fb create a new brand for its login system? No it's just login with fb, same with literally every login service except freaking persona. Use your most popular brand instead of forcing all developers to evangelize a new brand. That's just not going to freaking work.
If this is the case, why not just use pseudo-crypto cross-branding and just call it: "What does the Fox say?" 350M youtube views can't be wrong, can it?
Popularity is one thing, but if a user is using Persona login on Chrome or some non-FF supporting browser, and it says "Firefox login", they're probably going to be confused, and possibly close the tab. As a site owner who's implementing Persona, that's the exact opposite of seamless.
The problem with that is confusing users. When you have a "login with firefox" option you will get "but I don't use firefox anymore, I switched to chrome".
We use it at Mighty Spring (http://www.mightyspring.com) and it's pretty good! The documentation around backend setup is a bit confusing and doesn't cover some corner cases (like testing on dev servers) but with enough hacking you can get it to work. The front end plugin I went with (https://github.com/altryne/browserID-jQuery) needed a bit of tweaking (to both the code and docs, which was submitted to them), but other than that, relatively easy setup.
Our site is uniquely targeted at developers, so I felt that using Persona as a login option was only natural.
The one small complaint I would have is that it would be great if (after initial setup) the login process was a bit faster. It should be quicker than the old-school username and password IMHO, but with the animations and latency on authentication it all seems to feel a bit sluggish. Especially as the cookie for it expires frequently - which is a bit shit for users of a forum where you're normally signed in until you decide otherwise.
This is still in my minor complaint box because I suspect there's tweaks I could do which I haven't had time to explore yet.
The site cookie doesn't have much to do with the Persona bridge cookie. For example, for my sites, I expire users after a month, so they don't have to log in more frequently than that.
Persona never comes into it, unless they manually log out.
Edit: I've checked out the login process in the linked site, and it works well, but the popup window U/I seems like it's ripe for phishing attempts. It would be very easy to replicate the look of that window and fool people into thinking they're using Persona when they're not.
We used Persona for http://bit.ly/blibonline - and one of the problems we faced was that we would have liked the registration process to let our users tell us the name / icon (avatar), which was missing in Persona then. Any news on the timeline for these additions to Persona? (OpenID gives those two elements from registration/usage)
I really like the idea of Persona, and it's very easy to integrate with your own site. However, it's still a bit unreliable. For example, clicking on the zonino login button just opened a mostly-blank page for me (white on the left, light grey on the right, with a pointy arrow in the middle; a bar at the bottom says "Mozilla Person...", but no way to log in.
If I do "F10 -> View -> Page Style -> No Style" I see various boxes, but it's not obvious how to proceed. I entered my email into the top-most box and tried clicking the "next", "sign in" and "OK" buttons, but none of them responded (there's also "continue", but that's greyed out). I think I had the same problem when I tried it last year.
Probably just some browser plugin issue, but would be nice if it were easier to debug... Works in Chromium though.
On of my biggest problems with Persona (and why I stopped using it almost exclusively) is that the popup dialog is badly designed. For instance it has email and password as two consecutive fields which confuses my password manager greatly with different accounts. Secondly does it not work at all for me on mobile devices.
[+] [-] drew|12 years ago|reply
I would encourage you, though, to look carefully at your login completion metrics. I implemented Persona on my site (http://www.sixquestions.co) to have a pure email option and although users clearly prefer it, about 35% complete the Persona login flow successfully. That's 10 points lower than our next-worst performer (Twitter), and half the rate of our best performer (Facebook). For all the concerns people have with authorizing Facebook/Twitter access, that is (in my view) offset by the alien-ness of Persona's login flow. We've heard from lots of users that logging in with Persona is unusual and they thought they were doing something wrong because they'd never seen anything like that.
So, as much as I believe in Persona, I'm about to deploy a change that removes it entirely. It adds a lot of surface area to our testing and future development, but if it means we lose fewer users in their signup flow, it will be worth it.
[+] [-] rebelde|12 years ago|reply
I enter in the Gmail address that I use for registrations and other junk. I get the message: "Accounts don't match. You are currently signed into Google as [my normal Gmail address]. ... Force Google logout?" Forget that. I'm not interested in logging out of Gmail. Logging out of #1, into #2, out of #2 and back into #1 is more work that simple registration. I expect that I'm not the only person with this problem. I hope a solution can be found, because it would be really helpful.
[+] [-] kijin|12 years ago|reply
If you're in the business of implementing an alternative login system, you should also seriously think about what kind of UX you're competing against. Your ultimate competitor isn't Facebook or Twitter. It's the good old email-and-password login system that everyone is used to. You enter your email address, select a password, and you're in, without ever leaving the signup page! It's even easier if you use a password manager like LastPass. That's what you're competing against, and if your UX has any more steps or redirects than that, you're probably doomed.
[+] [-] zobzu|12 years ago|reply
1) users don't already have a personna account setup. They're used to hit their "login with FB/Google" account instead. They don't know that persona is better privacy-wise. So for many, it's just friction.
2) persona login sometimes appears slightly slower
[+] [-] StavrosK|12 years ago|reply
Unless by "clearly prefer it" you don't mean the initial button click, but the final login?
[+] [-] StavrosK|12 years ago|reply
[+] [-] cheshire137|12 years ago|reply
[+] [-] slaxman|12 years ago|reply
[+] [-] EGreg|12 years ago|reply
[+] [-] crayola|12 years ago|reply
[+] [-] dochtman|12 years ago|reply
https://github.com/mozilla/mod_authnz_persona
(I know Apache may not be that popular with the HN crowd anymore, but I don't currently have the time to dive into nginx and do the same for it. Nevertheless, if anyone wants to do that, I'd be happy to answer questions and provide pointers into the Apache code.)
[+] [-] StavrosK|12 years ago|reply
I really want to see it pick up steam and succeed, and I think the number one priority now is to implement plugins for major browsers. I hope the team picks up development again.
[+] [-] drdaeman|12 years ago|reply
Personally, I view Persona as just an awkward kludge that, while improves some important things, also does certain harm by pushing us one step away from making third parties mere notaries of one's identity, not its very providers.
Because it's me who's the source of my identity, nor my email provider nor domain registrar.
[+] [-] jdlshore|12 years ago|reply
The goals behind Persona are excellent: strong privacy protection and relieving website operators of cumbersome and error-prone authentication management. I love the idea. It's why I implemented Persona on my site.
The execution of Persona has been a bit wobbly. Logins are critical infrastructure and it doesn't feel like Mozilla is approaching Persona from that perspective. The team has been fantastic (thanks, callahad) but when things go wrong, it can take a long time for them to get resolved. Meanwhile, I'm left scrambling for a workaround.
An example: when the Yahoo bridge was implemented, it broke Persona for everyone who used a Yahoo alias [1]. A nasty break that returned a non-helpful error message. Something that serious merits an immediate rollback, in my opinion--but instead, it was left in place for several weeks until a interim solution was rolled out. The interim solution has some fairly serious UX problems, but the full solution has been open for 10 months now [2].
I want to love Persona, and I can't really afford the time required to do my own authentication, but it scares me that I'm so dependent on it.
[1] https://github.com/mozilla/persona-yahoo-bridge/issues/178
[2] https://github.com/mozilla/persona-yahoo-bridge/issues/201
[+] [-] davodesign84|12 years ago|reply
I believe it deserves it, but more collaborators should chip in, or more websites should use it in order to make it elegible for more resources.
[+] [-] jt2190|12 years ago|reply
[+] [-] yeukhon|12 years ago|reply
The important thing here is that as Persona protocol (BrowserID)'s creator, Mozilla really really wants someone else (potentially YOU the user) to run the Identity Bridge. Currently Mozilla does this for non-Gmail and non-Yahoo users too boost adoption. So when you sign up you are asked to give a new password on sign up. If you are paranoid, you should of course give a new password instead the one you use for your email (which I assume may be reused for multiple accounts...)
But being able to authenticate yourself on your own is what makes Persona useful.
edit: at realworld crypto, this was given as a talk. This is Google's possible direction.
http://www.ietf.org/proceedings/81/slides/tls-1.pdf
[+] [-] ericathegreat|12 years ago|reply
I wrote a whole thing on Persona a while back ( http://lepidllama.net/blog/trying-out-mozilla-persona-browse... ) but that ended up being the killer for me. It might be fine for activities like posting comments on a blog, but any site which stores or presents some aspect of who am I to the world needs to be a bit more secure than that!
[+] [-] sliverstorm|12 years ago|reply
Why we love/like X, And why you should, too
My immediate reaction is always something along the lines of, don't presume to tell me why I should like anything. Tell me why you like it, and be done with it.
[+] [-] eruditely|12 years ago|reply
[+] [-] eruditely|12 years ago|reply
[deleted]
[+] [-] sergiotapia|12 years ago|reply
https://github.com/sergiotapia/ASP.Net-MVC3-Persona-Demo
Authentication is simple to implement and you don't worry about user password protection.
I'm surprised interest has died down for the project given how easy it is to use. Maybe Mozilla should market it more?
[+] [-] hmans|12 years ago|reply
But it also proof that being awesome not only is not good enough to be successful, but simply doesn't matter. The user is not interested in a solution that is awesome, but one that doesn't scare him. And a big ugly third-party popup is as scary as stuff on the web gets these days.
Remember Ogg Vorbis?
[+] [-] pja|12 years ago|reply
Persona might find its own niche, even if it never completely displaces Facebook user authentication on the web.
[+] [-] jimktrains2|12 years ago|reply
We need to move towards protocols like SRP[0] in general so that no matter where I'm logging in, noöne has my password.
[0]: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
EDIT: As ubernostrum points out, Persona is solving a different problem than SRP does. However, one of the reasons different identities (username/password combinations) are encouraged currently is because providers can't be trusted with the secret of your password.
[+] [-] ubernostrum|12 years ago|reply
If you run your own identity provider, you are only trusting yourself with your secret.
Also, nothing about Persona requires password-based authentication -- you can use any mechanism you like to authenticate to your identity provider.
[+] [-] tptacek|12 years ago|reply
[+] [-] exo762|12 years ago|reply
You should avoid reusing your passwords across sites. BTW Persona helps you with that.
[+] [-] cantfindmypass|12 years ago|reply
Edit: looks like they may have have fixed it: http://support.mozilla.org/en-US/kb/how-do-i-manage-my-perso...
Though I'm not sure if it remains usable with hundreds of email addresses.
[+] [-] StavrosK|12 years ago|reply
You can add your domain as a catch-all, so you can authenticate with [email protected] and it will use a single account to authenticate. Services will still see your custom email address, but you only need one password.
[+] [-] eklavya|12 years ago|reply
[+] [-] JoshTriplett|12 years ago|reply
[+] [-] KaoruAoiShiho|12 years ago|reply
[+] [-] Flimm|12 years ago|reply
[+] [-] r00fus|12 years ago|reply
Popularity is one thing, but if a user is using Persona login on Chrome or some non-FF supporting browser, and it says "Firefox login", they're probably going to be confused, and possibly close the tab. As a site owner who's implementing Persona, that's the exact opposite of seamless.
[+] [-] unknown|12 years ago|reply
[deleted]
[+] [-] mixedbit|12 years ago|reply
[+] [-] asdasf|12 years ago|reply
[+] [-] Xeoncross|12 years ago|reply
[+] [-] ultimatedelman|12 years ago|reply
Our site is uniquely targeted at developers, so I felt that using Persona as a login option was only natural.
[+] [-] louthy|12 years ago|reply
The one small complaint I would have is that it would be great if (after initial setup) the login process was a bit faster. It should be quicker than the old-school username and password IMHO, but with the animations and latency on authentication it all seems to feel a bit sluggish. Especially as the cookie for it expires frequently - which is a bit shit for users of a forum where you're normally signed in until you decide otherwise.
This is still in my minor complaint box because I suspect there's tweaks I could do which I haven't had time to explore yet.
[+] [-] StavrosK|12 years ago|reply
Persona never comes into it, unless they manually log out.
[+] [-] drblast|12 years ago|reply
https://developer.mozilla.org/en-US/Persona?redirectlocale=e...
Edit: I've checked out the login process in the linked site, and it works well, but the popup window U/I seems like it's ripe for phishing attempts. It would be very easy to replicate the look of that window and fool people into thinking they're using Persona when they're not.
[+] [-] amalag|12 years ago|reply
[+] [-] pdfcollect|12 years ago|reply
[+] [-] StavrosK|12 years ago|reply
[+] [-] talex5|12 years ago|reply
If I do "F10 -> View -> Page Style -> No Style" I see various boxes, but it's not obvious how to proceed. I entered my email into the top-most box and tried clicking the "next", "sign in" and "OK" buttons, but none of them responded (there's also "continue", but that's greyed out). I think I had the same problem when I tried it last year.
Probably just some browser plugin issue, but would be nice if it were easier to debug... Works in Chromium though.
[+] [-] vertex-four|12 years ago|reply
[+] [-] the_mitsuhiko|12 years ago|reply