Mozilla Persona is a decentralized login system that allows users to log into websites using their email address rather than separate usernames and passwords for each site. It works by having a user's browser prove ownership of their email address to a website through a cryptographic signature, avoiding the need to reuse or remember passwords. The document discusses the problems with traditional password-based systems, how Persona addresses these issues through its decentralized design, and provides information for website operators to integrate Persona login on their domains.

1. François Marier – @fmarier
Mozilla Persona
for your domain

2. solving the
password problem
on the web

3. problem #1:
passwords are hard to secure

4. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

5. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

6. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

7. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

8. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

9. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery
2013
2013
password
password
guidelines
guidelines

10. passwords are hard to secure
they are a liability

11. ALTER TABLE user
DROP COLUMN password;

12. problem #2:
passwords are hard to remember

15. users have two strategies

16. 1. pick an easy password

18. 2. reuse your password

19. negative externality:
sites that don't care about security
impose a cost on more important sites

20. passwords are hard to remember
they need to be reset

22. control
email
account
control
all
accounts
=

23. existing login solutions

24. client certificates

25. SAML

28. existing login systems
are not good enough

29. ●
decentralised
●
simple
●
cross-browser

30. how does it work?

31. fmarier@gmail.com

32. getting a proof of email ownership

33. authenticate?

34. authenticate?
public key

35. authenticate?
public key
signed public key

36. you have a signed statement from your
provider that you own your email address

38. logging into a 3rd party site

39. Valid for: 2 minutes
wikipedia.org
assertion

40. Valid for: 2 minutes
wikipedia.org
check audience
assertion

41. Valid for: 2 minutes
wikipedia.org
check audience
check expiry
assertion

42. Valid for: 2 minutes
wikipedia.org
check audience
check expiry
check signature
assertion

43. assertion
Valid for: 2 minutes
wikipedia.org
public key

44. assertion
Valid for: 2 minutes
wikipedia.org

45. assertion
session cookie

46. demo #1:
http://crossword.thetimes.co.uk/
fmariertest@eyedee.me

47. Persona is already a
decentralised system

48. SMS with PIN codes

49. SMS with PIN codes
Jabber / XMPP

50. SMS with PIN codes
Jabber / XMPP
Yubikeys

51. SMS with PIN codes
Jabber / XMPP
Yubikeys
LDAP accounts

52. SMS with PIN codes
Jabber / XMPP
Yubikeys
LDAP accounts
Client certificates

53. SMS with PIN codes
Jabber / XMPP
Yubikeys
LDAP accounts
Client certificates
Password-wrapped secret key
{
"public-key": {
"algorithm":
"RS",
"n":"685484565272...",
"e":"65537"
},
"encrypted-private-key": {
"iv": "tmg7gztUQT...",
"salt": "JMtGwlF5UWY",
"ct": "8DdOjD1IA1..."
},
"authentication": "...",
"provisioning": "..."
}

54. decentralisation is the answer, but it's not
a product adoption strategy

55. we can't wait for all domains
to adopt Persona

56. we can't wait for all domains
to adopt Persona
solution: a temporary
centralised fallback

57. demo #2:
http://sloblog.io/
fmariertest@gmail.com

58. Persona already works
with all email domains

60. Persona supports
all modern browsers
>= 8

61. Persona is decentralised,
simple and cross-browser

62. how can I add Persona
support to my domain?

63. support document
https://eyedee.me/.well-known/browserid:
{
"public-key": {
"algorithm":"RS",
"n":"8606...",
"e":"65537"
},
"authentication": "/browserid/sign_in.html",
"provisioning": "/browserid/provision.html"
}

64. https://eyedee.me/.well-known/browserid:
{
"public-key": {
"algorithm":"RS",
"n":"8606...",
"e":"65537"
},
"authentication": "/browserid/sign_in.html",
"provisioning": "/browserid/provision.html"
}

65. https://eyedee.me/.well-known/browserid:
{
"public-key": {
"algorithm":"RS",
"n":"8606...",
"e":"65537"
},
"authentication": "/browserid/sign_in.html",
"provisioning": "/browserid/provision.html"
}

66. https://eyedee.me/.well-known/browserid:
{
"public-key": {
"algorithm":"RS",
"n":"8606...",
"e":"65537"
},
"authentication": "/browserid/sign_in.html",
"provisioning": "/browserid/provision.html"
}

67. https://eyedee.me/.well-known/browserid:
{
"public-key": {
"algorithm":"RS",
"n":"8606...",
"e":"65537"
},
"authentication": "/browserid/sign_in.html",
"provisioning": "/browserid/provision.html"
}

68. identity provider API
1. check for your /.well-known/browserid
2. try the provisioning endpoint
3. show the authentication page
4. call the provisioning endpoint again

69. identity provider API
1. check for your /.well-known/browserid
2. try the provisioning endpoint
3. show the authentication page
4. call the provisioning endpoint again

70. identity provider API
1. check for your /.well-known/browserid
2. try the provisioning endpoint
3. show the authentication page
4. call the provisioning endpoint again

71. identity provider API
1. check for your /.well-known/browserid
2. try the provisioning endpoint
3. show the authentication page
4. call the provisioning endpoint again

72. as an organization, you control:
●
details of the authentication process

73. as an organization, you control:
●
details of the authentication process
●
the duration of certificates

74. To learn more about Persona:
https://login.persona.org/
http://identity.mozilla.com/
https://developer.mozilla.org/docs/Persona/Quick_Setup
https://developer.mozilla.org/Persona/Implementing_a_Persona_IdP
https://github.com/mozilla/browserid-cookbook
https://developer.mozilla.org/docs/Persona/Libraries_and_plugins
https://wiki.mozilla.org/Identity#Get_Involved
@fmarier http://fmarier.org

75. © 2013 François Marier <francois@mozilla.com>
This work is licensed under a
Creative Commons Attribution-ShareAlike 3.0 New Zealand License.
Door man: https://secure.flickr.com/photos/wildlife_encounters/8024166802/
Top 500 passwords: http://xato.net/passwords/more-top-worst-passwords/
Parchment: https://secure.flickr.com/photos/27613359@N03/6750396225/
Cookie on tray: https://secure.flickr.com/photos/jamisonjudd/4810986199/
Uncle Sam: https://secure.flickr.com/photos/donkeyhotey/5666065982/
US passport: https://secure.flickr.com/photos/damian613/5077609023/
Stop sign: https://secure.flickr.com/photos/artbystevejohnson/6673406227/
Photo credits: