Unfortunately it isn't solving a problem that people have.

You answered this dilemma in your own message. Websites are using Google, Facebook, Twitter, GitHub, etc... for logging in. This solves a problem for publishers that want extra info on the user without asking (e.g. their email, their avatar) and users that care about privacy are simply siloing logins - e.g. I'm not connecting with Facebook for work related issues and I have a Google and a Twitter and a GitHub account too.

And surely, if it were popular, then Persona would be a good alternative. Unfortunately it has a chicken and egg problem.

> The lack of interest in pushing Persona forward has made me wildly change my stance on Mozilla.

Persona is simply an example of a product failing due to lack of interest and resources are limited - if you care so much, I'm sure they'll let you contribute ;-)

Besides, they aren't done yet.

I also push for it very hard in open source projects. This is where the change needs to happen. Wiki software such as mediawiki for example is ubiquitous, if it can be automatically configured to present the user with a Persona option a lot of people won't bother disabling it and will see it as a nice bonus.

And unlike OAuth, Persona can be readily available with zero configuration! It doesn't need API keys, that's the beauty of it!

Imagine Mozilla Persona being named Mozilla Login (recognition barrier down), being an integral part of the browser, just like Chrome does with Google Login (first use barrier down) and integrating seamlessly with Google and Facebook logins (registration barrier down).

I'd wager the user counts would be a significant percentage of Firefox users, making Mozilla Login a first-class citizen of Web Authentication APIs and breaking the chicken-and-egg problem. From there on, it'd be expectable that technical superiority could carry it to the top.

We actually did some testing along those lines, and it came back pretty negative. When "Mozilla" was too prominent, people did not expect it to work with other browsers, and wouldn't even attempt to use Persona.

For reference, I pulled this login screen from an image search on google: http://raygun.io/blog/2013/08/mozilla-persona-support/

The question must be asked: Does Persona have any chance of being used, in that context?

This branding issue can be compensated by having the browser pull out a dedicated login interface, or by really leveraging the known Mozilla brand (accepting the negative aspect you presented, which is inescapable). Without compensation, it is indeed a lost cause.

You _still_ have to pass verification details back to the Mozilla servers in order to discover whether the login information you're passed is valid, which (a) means that Mozilla can track all of your users and (b) slows everything down.

This is going to put any large site off of relying on it.

Business also prefer Twitter/Facebook/Google login, because they can get more info this way.

Persona as an alternative needs to be there and officially supported by Mozilla. I know they use it internally and "support" it, but the way they stopped all forms of promotion towards it etc makes it sound as if the protocol is abandoned.

Who cares what trendy new oauth2-based method RandomBlog#123 implements? Open source in general is very incremental. If it's there and solves a problem, it is a tool in the software engineer's belt. When it becomes apparent that companies don't permanently support their oauth2 "customers" and revoke all their API keys etc and Business asks "we can't have that happen again", then Persona becomes attractive. When updating the "log in with facebook" buttons will become tiresome because of social networks changing every few years, suddenly "logging in with the browser itself" becomes relevant.

It's an opportunity and they don't see the gain in it, but this is what "Keep the web open" is all about. Preventing every website in the world to depend on Google and Facebook's good graces. Protecting users from the really, really stupid password auth system.

The battle for federated authentication is kinda lost already. Big centralized authentication are a major advantage for both the authenthication providers (lockin) and users(information and assets provided) and consumers(ease of use).

I mean a sign in with Github is kind of awesome. You can authorize Travis or Circle to scan your repos and do their magic. Could Persona allow something like this? I kinda doubt it.

Sign in with Facebook allows you to see who of your friends is playing.

It's not meant to. Persona is not meant to replace OAuth as a data provider but as an authentication method.

When you log in with a third party auth, you don't necessarily want the site to have access to all your personal details. The reverse is also true: when you want the site to have access to your details from ShadySocialNetwork1952.ru, you don't necessarily want them to handle authentication for you.

OAuth was originally designed for sharing data. The way it works though allows for federated logins as all you are doing is checking that a person is who they say they are.

I do get a shiny icon that says sign-in and it pops a window that says I should login with given info.

EDIT: Thanks for downvotes, but I'm trying to demonstrate that those that use authentication won't really understand or value the complex background/guarantees of Persona.

The protocol does it right... it's up to marketing to sell it to the devs, and up to UX to sell it to the users.

And that is kind the crux of the issue, this protocol was a no sell to users and it didn't offer any incentive to the developer. To paraphrase your previous statement, it wasn't chicken and an egg. It was an chicken and an egg versus a goose and a golden egg.

People would pay for information/services (I think it gives you your friend graph + poking your friends) that FB connect allows you to have for free. Its users are 'taught' because developers made those logins ubiquitous, because more info on the customers. Or tighter integrations with services like Github. Or easier login experience (like StackExchange).

Except one thing: it requires cash (SSL cert[1]) you're stuck with the google/facebook/etc-style situation of having to rely on a 3rd party to maintain your identity.

It's not a popular opinion here where most people have well-paying tech jobs, but real identity and privacy on the net is something the retired, disabled, unemployed, single-parent, and other poor people need as well. Without solving this problem fist, you are simply incentivizing the current status quo and dooming any new scheme to fail.

[1] No, that SSL cert is not "cheap" when you have to live on SSDI that doesn't even cover rent/food/etc fully. The domain itself is less expensive, and can be sub-delegated between a few people.

I don't really get what you're getting at.

"The support document, provisioning page and authentication page must all be available over HTTPS, and the server's SSL certificate must be certified by a trusted CA whose certificate is in the standard Mozilla certificate bundle."

I suspect you're still stuck in the "users will just use somebody else as their identify provider" trap. We've seen where that leads - it gave us Hotmail, GMail, Facebook, G+, "MS passport", and the like. Persona, on the other hand, correctly allows anybody to host their own identity - iff you can pay for it.

"millions of users"

Stop with the narrow thinking - that's not the only use-case for encryption, as the internet is not a many-to-one medium like TV. The personal website I put up for my friends should be encrypted, just like everything else we send over the net.

And if you can't use HTTPS, nothing on your site is secure, so fussing over which authentication system you're going to critically compromise seems a bit academic.

A domain is free, if it's delegated. It's also something many people already have.

StartSSL is not an option (had problems with them pre-openssl-mess; absolutely not an option now).

This stuff misses the point, though: REAL privacy (not relying on a 3rd party like facebook) is a selling point that is becoming more popular "post-snowden". While I assume technical challenges can be made point-and-click easy over time, requiring cash is a hurdle that will shut out MANY people. Evidence: free email vs minor-fee/year email.

Right now, any competing service is already up against the hurdle of trying to get people to switch from what they currently use (facebook, google). The idea of not being tide to a big company is enough to overcome that hurdle, for at least some people. Requiring cash scraps that window of opportunity, sometimes for actual cash-availability reasons, and others for perceived reasons.

I don't see how they're worse than no security at all, which is the alternative you appear to be proposing.