Mozilla shutting down Persona

[Posted January 12, 2016 by corbet]

Mozilla has announced that it will be shutting down the persona.org authentication service in November. It has been two years since Persona was "transitioned to community ownership"; now the other shoe has dropped. "Due to low, declining usage, we are reallocating the project’s dedicated, ongoing resources and will shut down the persona.org services that we run. Persona.org and related domains will be taken offline on November 30th, 2016." There is a set of "shutdown guidelines" to help sites still using Persona to transition to something else. (LWN looked at Persona in 2013).

Mozilla shutting down Persona

Posted Jan 12, 2016 16:35 UTC (Tue) by mlinksva (guest, #38268) [Link]

https://news.ycombinator.com/item?id=10884893 discussion has some pointers to possible new decentralized auth projects, see comments by
iheartmemcache and StavrosK.

Mozilla shutting down Persona

Posted Jan 12, 2016 18:00 UTC (Tue) by flussence (guest, #85566) [Link] (5 responses)

I vaguely remember reading all these stereotypically grandiose visions of passwordless one-click authentication, right from the browser chrome, and how it'd be an OpenID killer, etc. etc.

...and that's about all I ever heard of it. Seems like OpenID won the fight because its opponent just never showed up.

TOTP seems to have won the war, though.

Mozilla shutting down Persona

Posted Jan 12, 2016 18:57 UTC (Tue) by pizza (subscriber, #46) [Link] (4 responses)

>...and that's about all I ever heard of it. Seems like OpenID won the fight because its opponent just never showed up.

Actually, OpenID has pretty much lost as well, at least if your name isn't google, microsoft, or facebook.

It was grand idea, but one that was doomed to never gain any industry traction because the vested interests want to own your identity, rather than merely accepting it.

Mozilla shutting down Persona

Posted Jan 13, 2016 12:59 UTC (Wed) by mstone_ (subscriber, #66309) [Link] (3 responses)

A lot of sites are happy to accept 3rd party credentials, I think there's skepticism from the consumer side that the site isn't trying to do something spammy/scammy when asking you to log in using facebooks/whatever.

Mozilla shutting down Persona

Posted Jan 13, 2016 15:26 UTC (Wed) by Wol (subscriber, #4433) [Link] (2 responses)

Unfortunately, a lot of sites only give you the option of facebook. And a lot of people (like me) just REFUSE to have a facebook account.

If a site lets me log in using my google id, I may or may not. If a site demands a facebook id (and many no longer give you the option of "local" account!) then I just won't go there. There are a few blogs I regularly come across where you need a facebook id to post - sorry you won't get anything from me!!!

Cheers,
Wol

Mozilla shutting down Persona

Posted Jan 13, 2016 15:30 UTC (Wed) by NAR (subscriber, #1313) [Link] (1 responses)

I didn't want to give my personal social network to Facebook - but then realized that Facebook already had most of it. Many of my friends had Facebook accounts, allowed Facebook to look into their contact lists containing my e-mail address, so Facebook got the network anyway.

Mozilla shutting down Persona

Posted Jan 13, 2016 16:02 UTC (Wed) by nybble41 (subscriber, #55106) [Link]

Add to that that an empty Facebook account with no "friends" or other profile information can still be used to authenticate to other sites which require it. Having an active login does give away some additional tracking information, but you can mitigate that by only logging in as necessary from an Incognito / Private Browsing window.

Mozilla shutting down Persona

Posted Jan 13, 2016 6:48 UTC (Wed) by grahame (guest, #5823) [Link] (6 responses)

I got really excited about Persona - especially the idea that it would be integrated right into browsers - and built an application using it. Now I've got a few hundred users on there and I'll have to figure out how to authenticate them post November next year. It was a good effort, wish it had succeeded :-)

Mozilla shutting down Persona

Posted Jan 13, 2016 11:25 UTC (Wed) by pabs (subscriber, #43278) [Link]

Switch to client-side SSL certs?

https://wiki.debian.org/DebianSingleSignOn

Mozilla shutting down Persona

Posted Jan 13, 2016 13:46 UTC (Wed) by krake (guest, #55996) [Link] (4 responses)

Isn't running your own Persona server an option?

Mozilla shutting down Persona

Posted Jan 13, 2016 18:11 UTC (Wed) by bronson (subscriber, #4806) [Link] (3 responses)

grahame: November THIS year. :)

Apparently running it yourself is not a great option. Part of the reason Moz dropped it is that it had some feature creep and unfortunate dependencies baked deep... makes deploy/maintenance harder than it should be and not an easy fix.

Just comes down to what you want to spend your time on. Seems like it would be more productive to work on switching. However, I haven't actually tried running Persona so that's just a wild guess.

Mozilla shutting down Persona

Posted Jan 13, 2016 22:32 UTC (Wed) by flussence (guest, #85566) [Link] (2 responses)

If those reasons were why it was dropped, it doesn't bode well for the future of a lot of their other infrastructure...

Firefox Sync suffered from that problem too, according to what I heard from brave people who attempted to run their own instance of it; that was before it underwent a total redesign which didn't come with an accompanying code drop. The official Let's Encrypt client is just as much of a flying spaghetti monster, but thankfully it has as many alternatives as there are dependencies.

Mozilla shutting down Persona

Posted Jan 14, 2016 1:06 UTC (Thu) by pizza (subscriber, #46) [Link] (1 responses)

Yeah, I still have a v1.x ffsync server running. It wasn't that bad to set up, and it's been worry-free ever since.

That is, until the FF clients yanked the UI that lets you actually configure and utilize it, replacing it with v2.x that requires authenticating against mozilla services, running counter to the entire point of running a sync instance oneself.

...sigh.

Mozilla shutting down Persona

Posted Jan 29, 2016 15:35 UTC (Fri) by mathstuf (subscriber, #69389) [Link]

You can run your own auth server as well for 2.x. That said, getting 2.x to actually run is much harder than 1.x was (I had at least gotten 1.x to react to Firefox clients, but 2.x just sits and spins since there's way more work involved).