Mozilla Persona: privacy preserving authentication service
Several companies, Google, Facebook and Twitter to name three, offer their own authentication services to third party websites. What this means is that you can register an account on third party websites using your Google , Facebook or Twitter account. The benefit here is that you usually only have to authorize the new service or site using an existing account so that you do not have to fill out a sign up form and select a password to do the same.
So, you sign up faster and do not need to juggle around with different secure passwords. While that is great and all, it also means that the company that is providing you with the service gets the opportunity to track you around the web.
Mozilla's Persona, not to be confused with basic Firefox themes previously known as Personas, is an authentication service that looks on first glance similar to the other authentication services that you find on the Internet.
The basic idea is to use one account for multiple sign ups on the Internet. Sites supporting Persona are rare at the moment, with The Times Crossword probably the biggest one right now.
Let me show you how it works in detail:
- First thing you need to do is create an account on the site if you have not done so already. To do so, enter an email address and password to create the account.
- You will receive a confirmation email to verify the email address.
Once you have created the account, you can use it to log in on sites that support Mozilla Persona. Just click on the Log in button on those sites to start the process. A window should open up that displays your Persona identity and the option to sign in.
You can change the email address here if it is not yours or if you want to use another. A second screen is displayed to you after you have clicked on sign in. Here you can specify for how long you want to remain singed in on the website. Options are to stay signed in for a month or for that session only. And that's it. No need to enter a username or password anymore, everything is handled in the background.
So far so identical to other authentication services. What sets Mozilla apart is the focus on user privacy. Where other services may use the data for marketing purposes, Mozilla designed the system to be open and decentralized which basically means that any site can hosts its own Identity Provider that is used for the authentication.
Persona on top of it does not phone home before it is allowing users to connect to a site. This is done by using the browser as a middleman so that communication goes through the browser which acts as a proxy between the email provider and the website the user wants to log in to.
Mozilla notes that it will take time before Persona will reach a certain stage of popularity. It remains to be seen how well it will fare against established systems.
Update: not launched yet out of beta.
Advertisement
Personally, I wish Mozilla had used the time and resources needed to develop this (potentially redundant) service to keep Thunderbird alive and/or to reduce the huge amount of open Firefox bugs at Bugzilla instead.
Is it ironic to say/think that this will only catch on if FB or Google implement it?
I like the concept of an independent company like Mozilla doing this and I hope it succeeds.
OpenID clone? I kind of agree with city_zen, perhaps resources could be focused elsewhere
I don’t think this will catch up with the competition, so I agree that the resources would be better spent somewhere else.
“What sets Mozilla apart is the focus on user privacy.Where other services may use the data for marketing purposes…..” Should make it welcome everywhere [rolleyes]
Hey all! I’m an engineer on the Persona team.
Yesterday’s blog post was not announcing a product launch. It was just a reminder that Persona already supports distributed identity providers. Persona’s official beta launch was in September of last year (it was covered by this blog, among others), but it attracted interest before then as BrowserID.
Persona importantly differs from other standards, like OpenID, and from proprietary login systems, like FB Connect. Have a look at our docs to learn more: https://developer.mozilla.org/Persona
Soon we will need to remember passwords for the various services that help us sign in to other services :p
I guess people will say just use LastPass or KeePass.
We believe in Persona as an opportunity of increasing the conversion rate by reducing the barrier to entry. So that we have just integrated this authentication system on mitbaby social network, for new and existing users. We hope this system spreads across the internet, although it will take some time…