In short, three big differences:

1. Identifiers are email addresses, not strange URI things, which is good because users are already comfortable with emails identifying them.

2. Privacy: Your OpenID provider can see what services you log into. Not true with Personas, which was a big deal for Mozilla and for me.

3. Browser integration: The APIs are currently implemented with a javascript shim, but the browser can step in (either via native support or an extension) to provide new, exciting types of authentication -- dongles, certificates, interpretive dance via a kinect, etc.

The service can verify the user's cert against the identity provider's public key with this information. The service initially contacts the identity provider to get the provider's public key, so the identity provider can infer that someone is attempting to log into the service as one of its users.

Once the service has the provider's public key, it can be cached by the service until it expires, and while it's cached, the service can verify logins without contacting the server again by checking that the cert presented by the user to the service has a legitimate signature from the identity provider's public key.

So if someone logs into HN using their Gmail ID (assuming both services grow support for the protocol), all Gmail knows is that at least one person attempted to log into HN using a gmail address. Who was trying to log in, whether that login was successful, and the number of other people who logged into HN with Gmail after that, are all facts that would be completely hidden from Google.

I'm guessing there's some sort of timestamp there, to prevent someone from just stealing the cert and logging in to whatever they want as that user.

The main actual deployed usage of the technique is in TPM's for direct anonymous attestation. http://en.wikipedia.org/wiki/Direct_Anonymous_Attestation

IBM explains their project here http://www.zurich.ibm.com/idemix/details.html

The original academic work its based on is this http://cs.brown.edu/~anna/papers/cl01a.pdf

A different(and older) technique which, by my understanding, is mainly useful for smart cards, is deployed in a prototype system from microsoft : http://research.microsoft.com/en-us/projects/u-prove/

In short, your browser asks the identity provider to sign a certificate proving that you are [email protected]. The browser will then use that certificate to authenticate you on the site. The site can check this certificate by getting the pubkey from the identity provider. You are never associated with the site you are authenticating against (except on very low traffic identity providers)

Notice that provisioning (steps 1 and 2) and logging into a site (steps 3 and 4) are two completely independent processes, with the browser mediating any identifiable identity-provider-to-target-site communication.

Re: Downvotes: It's a pretty common question that we (the Persona team) have clearly not done a good enough of a job of communicating. I imagine a lot of folks here are just tired of the repetition.

It would be nice if you created a example Persona-enabled web application (some lines of gulp PHP or heck even a VirtualBox image), push it to bitbucket/github/whatever and link to the repo from http://www.mozilla.org/en-US/persona/. Does not need any functionality, just a login screen using Persona and a "it works" page you reach after logging in. And maybe sample ID provider code too. Extra cookie points if the "it works" page explains the structure of this Proof of Concept application and how the Persona protocol was used.

This way, a curious developer could pull the source, have a Persona-enabled template app and his own ID provider up and running in minutes and could play around with it, evangelize it in his organization etc. If it "feels" right, said developer would read the docs afterwards to move beyond the Proof of Concept.

Look for it soon. :)

1. You still have to remember which email you had used to login. This was heavily criticized with OpenID ("did I login with Google or MyOpenID?" kind of situation). With emails it just got worse, as you will have problem, especially if you're trying to fight spam using service-specific emails ([email protected]).

2. You still can't "migrate" from one email address to another. Shall your email provider go down or you lose your domain - you lose your identity.

3. You still don't own your own identity. The identity is just leased to you by your email provider (or your domain registrar).

https://addons.mozilla.org/en-US/firefox/addon/openid-for-fi...

(I have not actually tested this add-on myself.)

While the goals are similar, the ways differ. With perosona, the focus is on emails as the identifier. In case of OpenID, the identity provider may or may not have used email id as identifier.

Hope it helps a bit.

EDIT: And somebody downvoted this comment. Oh no, I lost 1 HN point! What . will . I . ever . do?

https://developer.mozilla.org/en-US/docs/Persona/FAQ

You may also wish to take a look at the Mozilla Persona Developer FAQ:

http://www.mozilla.org/en-US/persona/developer-faq/

It's easier for users since it relies on email addresses instead of a URL, easier for developers thanks to its simple API, and tracking information is never leaked back to the identity provider.

There are ways to formulate the same question which would be much nicer and less negative, for example:

"It's great to see other solutions providing things similar to OpenID. Can anyone explain what are the differences with OpenID?"

Simply writing: "How is this different from XXX?" just sounds rude and negative.

That's what makes me disagree. I want honest comments and thoughtful reading.

To break that down further:

We have a comment "How is this different from X?" which can be interpreted literally, as an honest question, or with the assumption that what he actually meant is "This is stupid because we already have X".

One solution is to encourage people to write "No offense to the project, It looks interesting but I honestly don't know what differentiates it from X, and if you could explain it in contrast to X I will understand it better since I already understand X"

That's ... ok, but the writer will never anticipate every possible misinterpretation so you will have verbose comments full of fluffy meaningless language and still have the same problem.

The alternative is encouraging people to think about the phrase "benefit of the doubt", what it means and why it's a well known phrase in the first place.

If someone asks "How is this different from X" then you take it to mean what it says, you don't try to guess at what possible negative thing he might have meant. So the replies would all take that comment seriously.

What's the downside? Someones snarky comment would be read as honest and there would be an answer. Who's going to reply with "I actually meant that sarcastically"? Some people might, but they'll just look foolish.

If the choice is between:

1. encouraging a culture where questions are taken as honest questions or 2. one where every question is scrutinized for the slightest possible clue of hidden negative meaning and you have to fill your comment with false praise and legal and marketing language to avoid any possibility of the suggestion of offense

Then the answer is obvious to me.

I'm used to an Internet where you're not required to be so goddamned polite. Seems to me it becomes the spidery veneer of Silicon Valley networking; insincere, self-interested, and a corruption of what it means to be 'nice.'

I mean, look; the OP asked a really good, terse question and got downvoted presumably because it was 'rude.' That's just silly.

The discussion here started because of the statement that he was probably downvoted because "how is this different from X?" is interpreted as "This is stupid, we already have X."

That just sounds like a direct question to me - not rude or negative.

"It's great to see other solutions providing things similar to OpenID"

I don't see what that adds - everyone reading this already knows it is a solution similar to OpenID so why restate it?

Note that I also apologise if you think this reply is rude - I'm really not meaning to be.

It reads like a perfectly reasonable question to me. Where exactly are you finding rudeness and negativity?

You asked a good question. HN's not very good at self-regulating. Negativity is regarded negatively in some bizarre self-perpetuation cycle.

http://identity.mozilla.com/post/45842909320/users-dont-like...