8 ms·

Mozilla Identity dev here. The reason for that was due to a large degree to time and priorities. We were close to shipping Persona preffed off in Firefox over

by jedp 13y ago

Mozilla Identity dev here. The reason for that was due to a large degree to time and priorities. We were close to shipping Persona preffed off in Firefox over 18 months ago. Then FirefoxOS came along and our focus was changed to implementing Persona as the sign-in system on the device (which we did; it's natively supported there). FirefoxOS has been a massive effort on behalf of the whole company, and it has diverted crucial resources from the Persona effort on desktop. Then we shifted our focus again to Firefox Accounts and revising Sync. A native implementation of Firefox Accounts should be landing in FirefoxOS 1.4. As a result, we have native BrowserID support (both Persona and Firefox Accounts use this protocol) in FirefoxOS and as a backbone in desktop Firefox. There is a lot of persona in Firefox right now, but sadly you can't see it. Despite these massive efforts, we still have not been able to land the last patches to surface this in the UI on desktop. And you're right, it appears to send the message that Mozilla did not see enough importance in federated, user-controlled identity on the web to make sure it landed in the desktop browser. But Mozilla, like all organizations, has to balance its priorities. There's a lot going on, and the decision was made that other projects would take priority. I hope the decision is revised in the future. If it looked half-hearted, I can assure you it was not from lack of effort or dedication from the team. We believe in Persona and poured our hearts into it.

beefman 13y ago
Thanks for the info. I don't think anyone's accusing the Persona team of being half-hearted. Execution was great! But I will accuse Mozilla leadership of being tragically poor. It's nice to think about "sustainability" in a post-web world, but sustainability for Mozilla must start with Firefox. Mozilla is Firefox. And Mozilla has the billions to make it rock. So when resources are diverted away while there's still work to do, you should see red flags and look for better focus right away. When Apple was the iPod, we made damn sure it was the best possible iPod before anything else.
- cbtacy 13y ago
  "And Mozilla has the billions to make it rock." Really? What do you base that statement on?
  - beefman 13y ago
    They have a contract with Google that guarantees them $1B over 3 years. http://www.zdnet.com/blog/btl/google-paying-mozilla-300-million-per-year-for-search-deal/65921 http://www.zdnet.com/blog/btl/google-paying-mozilla-300-mill...
    - yeukhon 13y ago
      1B is very little. I would focus on your other point: So when resources are diverted away while there's still work to do, you should see red flags and look for better focus right away.
      - dllthomas 13y ago
        I'm not sure 1B is very little - it's thousands of programmer-years. It is weird to characterize 1B over 3 years as "billions" unless there are substantial funds coming from other sources.
        tedmielczarek 13y ago
        That's the vast majority of Mozilla's income, you can check the publicly-available financials. It's small potatoes compared to the companies Mozilla competes against: Google, Apple, Microsoft.
mook 13y ago
Did the FirefoxOS Persona stack move away from having an iframe point at a remote location at some point? I mean, the API was still in flux, as far as I know (last thing I heard was lloyd's blog post in January; it seems to be mostly FxA since). If the core transport can't get narrowed down, people can't actually federate with it.
mmayo 13y ago
Disclosure: the Identity team at Mozilla work for me. tldr; we couldn't get it to work. Let's get something straight first. I'm not a fan of excuses. Persona failed to achieve its goals, and I'd rather we own up to what it was good at, and what it failed at, learn from it, and keep fighting for better authentication on the internet because that's what matters. We play to win at Mozilla based on the principle that to have influence in a market, you need adoption. We're willing to play the long game when we have some line-of-sight to success, in other words, but it was clear that even if we had a team of 100 on Persona we were not going to see adoption. Persona was never close to being shippable on desktop. It's true that we spent effort trying to make Persona work for Firefox OS, and that effort did not result in a fantastic on-device experience. Sign-in to web? Yes. Sign-in to device? Not so much. Federated login is really hard, unsurprisingly, for UX reasons as much or more than raw technology reasons. This is difficult stuff, and changing user expectations about how an "account" works is very, very difficult. As the AAR linked to in this post iterates, there were a lot of factors involved in why Persona never took off, but most important was the 3-way cold-start due to needing large numbers of users, supporting IdPs (email providers), and many RPs (websites) before the system as a whole could get to critical mass. There was simply no evidence at all that adding a native implementation would have pushed any of the large IdPs (i.e. email providers) to support the system. In fact, the opposite is true; when we decided to start offering more Firefox services ourselves we effectively had the kinds of authentication/authorization challenges any large IdP would have and we found Persona unfit for our needs. (entropy generation as one example, covered in the FAQ) We could have kept adding complexity to Persona to support Firefox/Mozilla specific use cases, but I believe we made the right call and let Persona focus on its core value prop - sign-in to the web with a verified email. We spent time and money to stabilize and fix inconsistencies in the API, and signed up to continue running the core secondary service for the Internet. We've invested heavily, and continue to invest in pushing identity on the web forward. One last comment: It's important to note here that we did choose the underlying BrowserID protocol for use with Firefox accounts, incurring significant engineering cost (supporting your own authentication stack is not free), so that if we're successful in becoming a large IdP, we get a chance to fight this federation fight again without being in an adoption stalemate next time. Will that future system be exactly Persona? Almost certainly not -- we have to be willing to iterate the design and protocols until we've got something that works -- but we do believe that BrowserID/VEP is the right technology to be building from, and that we should let Persona continue to fulfill its current sweet spot for sign-in to the web for sites that love the way Persona works.

by jedp 13y ago

beefman 13y ago

Thanks for the info. I don't think anyone's accusing the Persona team of being half-hearted. Execution was great! But I will accuse Mozilla leadership of being tragically poor. It's nice to think about "sustainability" in a post-web world, but sustainability for Mozilla must start with Firefox. Mozilla is Firefox. And Mozilla has the billions to make it rock. So when resources are diverted away while there's still work to do, you should see red flags and look for better focus right away. When Apple was the iPod, we made damn sure it was the best possible iPod before anything else.

cbtacy 13y ago
"And Mozilla has the billions to make it rock." Really? What do you base that statement on?
- beefman 13y ago
  They have a contract with Google that guarantees them $1B over 3 years. http://www.zdnet.com/blog/btl/google-paying-mozilla-300-million-per-year-for-search-deal/65921 http://www.zdnet.com/blog/btl/google-paying-mozilla-300-mill...
  - yeukhon 13y ago
    1B is very little. I would focus on your other point: So when resources are diverted away while there's still work to do, you should see red flags and look for better focus right away.
    - dllthomas 13y ago
      I'm not sure 1B is very little - it's thousands of programmer-years. It is weird to characterize 1B over 3 years as "billions" unless there are substantial funds coming from other sources.
      - tedmielczarek 13y ago
        That's the vast majority of Mozilla's income, you can check the publicly-available financials. It's small potatoes compared to the companies Mozilla competes against: Google, Apple, Microsoft.

mook 13y ago

Did the FirefoxOS Persona stack move away from having an iframe point at a remote location at some point? I mean, the API was still in flux, as far as I know (last thing I heard was lloyd's blog post in January; it seems to be mostly FxA since). If the core transport can't get narrowed down, people can't actually federate with it.

mmayo 13y ago

Disclosure: the Identity team at Mozilla work for me. tldr; we couldn't get it to work. Let's get something straight first. I'm not a fan of excuses. Persona failed to achieve its goals, and I'd rather we own up to what it was good at, and what it failed at, learn from it, and keep fighting for better authentication on the internet because that's what matters. We play to win at Mozilla based on the principle that to have influence in a market, you need adoption. We're willing to play the long game when we have some line-of-sight to success, in other words, but it was clear that even if we had a team of 100 on Persona we were not going to see adoption. Persona was never close to being shippable on desktop. It's true that we spent effort trying to make Persona work for Firefox OS, and that effort did not result in a fantastic on-device experience. Sign-in to web? Yes. Sign-in to device? Not so much. Federated login is really hard, unsurprisingly, for UX reasons as much or more than raw technology reasons. This is difficult stuff, and changing user expectations about how an "account" works is very, very difficult. As the AAR linked to in this post iterates, there were a lot of factors involved in why Persona never took off, but most important was the 3-way cold-start due to needing large numbers of users, supporting IdPs (email providers), and many RPs (websites) before the system as a whole could get to critical mass. There was simply no evidence at all that adding a native implementation would have pushed any of the large IdPs (i.e. email providers) to support the system. In fact, the opposite is true; when we decided to start offering more Firefox services ourselves we effectively had the kinds of authentication/authorization challenges any large IdP would have and we found Persona unfit for our needs. (entropy generation as one example, covered in the FAQ) We could have kept adding complexity to Persona to support Firefox/Mozilla specific use cases, but I believe we made the right call and let Persona focus on its core value prop - sign-in to the web with a verified email. We spent time and money to stabilize and fix inconsistencies in the API, and signed up to continue running the core secondary service for the Internet. We've invested heavily, and continue to invest in pushing identity on the web forward. One last comment: It's important to note here that we did choose the underlying BrowserID protocol for use with Firefox accounts, incurring significant engineering cost (supporting your own authentication stack is not free), so that if we're successful in becoming a large IdP, we get a chance to fight this federation fight again without being in an adoption stalemate next time. Will that future system be exactly Persona? Almost certainly not -- we have to be willing to iterate the design and protocols until we've got something that works -- but we do believe that BrowserID/VEP is the right technology to be building from, and that we should let Persona continue to fulfill its current sweet spot for sign-in to the web for sites that love the way Persona works.