Skip to content
Hallway
0:00 / 0:00

#mozillapersona#authentication#passwordless

Beyond Passwords: Secure Authentication with Mozilla Persona

Next Day Video

68K subscribers • 16 videos on Hallway

YouTube
  • Recommended by 1 person: 1 on Hacker News.
  • Presented by Dan Callahan, Mozilla
  • May be out of date. The tools, versions or practices it shows have likely moved on.

Intermediate. Assumes working knowledge.

2.9K views13 years ago1 recommendation

SecurityWeb developmentHTTP, REST and GraphQLCryptographyPrivacy and surveillance

Dan Callahan explains the design and implementation of Mozilla Persona, a decentralized, passwordless authentication system.

Dan Callahan Mozilla Persona is a decentralized, cross-browser authentication system that completely eliminates website passwords. It's simple, secure, and privacy-protecting. This talk explores the design of Persona with a focus on adding it as a lo

Why it's here

1 person recommends this

What people say. Recommended as an elegant, historically significant explanation of decentralized, email-based passwordless authentication.

spellbootson Hacker News • Recommends

On “Show HN: No More Passwords, Just Email”

Please use Persona, it's this idea but much more thoroughly thought out and tested. Here is a great video about it: link to this video If you have not heard of Persona, or have heard of it but don't see what the big deal is / why it's different to "Login with google", "Login with twitter" etc, then go watch this video. It is a very elegant, decentralised solution to the login problem.
View on Hacker News

callahadon Hacker News • Mentions

On “Persona is distributed. Today.”

Check out around the 16:00 mark in this video: link to this video Notice that provisioning (steps 1 and 2) and logging into a site (steps 3 and 4) are two completely independent processes, with the browser mediating any identifiable identity-provider-to-target-site communication.
View on Hacker News

callahadon Hacker News • Mentions

On “OAuth Has Ruined Everything”

Persona didn't have the notion of a global password -- the ideal flow had you authenticating with your email provider, on their domain, which was often completely transparent in cases where you were already signed in to that provider. Try logging into 123done.org with whatever you want @mockmyid.com to get a sense of what that would ideally look like. My talk from PyCon 2013 goes into a little detail about how the protocol works: link to this video
View on Hacker News

zeristoron Hacker News • Mentions

On “OAuth Has Ruined Everything”

I've learnt a lot from this thread, I'd not heard of Mozilla Persona before. Could it be The One Ring to rule them all? Charles Stross has his Rule34, I propose Rule 42 is that if something exists there must be a YouTube video of it. This one of a Dan Callahan presentation from a few years back link to this video With Rule38 being a blend of the two.
View on Hacker News

callahadon Hacker News • Mentions

On “Portier – An email-based, passwordless authentication service”

There's a little more discussion of that over on Lobsters: link . The TL;DR is that URIs just didn't work for the mass public. You had to supplement the login form with a NASCAR-esque wall of logos, which was awful for different reasons. Thus, Portier, and Persona before it, chose to identify users by email addresses. I talk a little bit about that at 9:05 in my PyCon 2013 talk on Persona: link to this video
View on Hacker News