I don't get this mindset. It was pushed for barely a few months. Firefox took years to even come close to making a serious dent in the market share. Should they have given up after a year and said "The userbase has spoken and prefers IE"?

Persona as an alternative needs to be there and officially supported by Mozilla. I know they use it internally and "support" it, but the way they stopped all forms of promotion towards it etc makes it sound as if the protocol is abandoned.

Who cares what trendy new oauth2-based method RandomBlog#123 implements? Open source in general is very incremental. If it's there and solves a problem, it is a tool in the software engineer's belt. When it becomes apparent that companies don't permanently support their oauth2 "customers" and revoke all their API keys etc and Business asks "we can't have that happen again", then Persona becomes attractive. When updating the "log in with facebook" buttons will become tiresome because of social networks changing every few years, suddenly "logging in with the browser itself" becomes relevant.

It's an opportunity and they don't see the gain in it, but this is what "Keep the web open" is all about. Preventing every website in the world to depend on Google and Facebook's good graces. Protecting users from the really, really stupid password auth system.

Well, they could either push that or push their phone OS. I think their FxOS is kind of more important battle.

The battle for federated authentication is kinda lost already. Big centralized authentication are a major advantage for both the authenthication providers (lockin) and users(information and assets provided) and consumers(ease of use).

I mean a sign in with Github is kind of awesome. You can authorize Travis or Circle to scan your repos and do their magic. Could Persona allow something like this? I kinda doubt it.

Sign in with Facebook allows you to see who of your friends is playing.

> Could Persona allow something like this? I kinda doubt it.

It's not meant to. Persona is not meant to replace OAuth as a data provider but as an authentication method.

When you log in with a third party auth, you don't necessarily want the site to have access to all your personal details. The reverse is also true: when you want the site to have access to your details from ShadySocialNetwork1952.ru, you don't necessarily want them to handle authentication for you.

OAuth was originally designed for sharing data. The way it works though allows for federated logins as all you are doing is checking that a person is who they say they are.

Users won't get that. Hell I'm a layman (security wise) and I don't get that.

I do get a shiny icon that says sign-in and it pops a window that says I should login with given info.

EDIT: Thanks for downvotes, but I'm trying to demonstrate that those that use authentication won't really understand or value the complex background/guarantees of Persona.

I didn't downvote you. I can't even downvote you. But users aren't meant to "get" that - developers are.

The protocol does it right... it's up to marketing to sell it to the devs, and up to UX to sell it to the users.

No worries, I was speaking towards those that did downvote me.

And that is kind the crux of the issue, this protocol was a no sell to users and it didn't offer any incentive to the developer. To paraphrase your previous statement, it wasn't chicken and an egg. It was an chicken and an egg versus a goose and a golden egg.

People would pay for information/services (I think it gives you your friend graph + poking your friends) that FB connect allows you to have for free. Its users are 'taught' because developers made those logins ubiquitous, because more info on the customers. Or tighter integrations with services like Github. Or easier login experience (like StackExchange).