Mozilla Persona privacy protections trump Facebook in single sign-on

Persona Beta 2 includes new Identity Bridging feature, allowing users to log into supported sites with existing Webmail accounts

Mozilla today unveiled Persona Beta 2, the newest edition of the organization's open authentication system, designed to let users sign into Web apps and services without creating new user names and passwords. The release includes a feature called Identity Bridging, which lets user sign in to Persona-supported sites using their existing Webmail accounts, starting with Yahoo.

At first blush, Persona may sound a lot like the single sign-in features offered by Facebook and Twitter. However, Mozilla asserts that the Persona approach better protects user privacy. "Facebook and Twitter sign-in conflate the act of signing into a website with sharing access to your social network, and often granting the site permission to publish on your behalf," said Lloyd Hilaiel, technical lead for Mozilla Persona. "Sometimes this is what a user wants, but far too often, it's absolutely not. People get really upset when advertisements or high scores are broadcast to their friends unexpectedly."

What's more, Hilaiel said that these existing social sign-in offerings "are built in such a way that social providers have full visibility into a user's browsing behavior."

Hilaeil also talked up benefits of Persona to developers, citing a more streamlined sign-in that appeals to users, as well as the fact that developers don't need to develop or maintain authentication code themselves and don't "have to handle a user's password, so there is less risk for users is the server gets compromised."

Mozilla's announcement focused primarily on the new Identity Bridging feature, which lets users sign into Persona-supported sites using an existing OpenID- or OAuth-supported Webmail account. "We built a bridge -- a server that speaks the Persona IdP protocol on one side and OpenID or OAuth on the other -- to use these existing services," according to a blog post co-written by Hilaeil and Mozilla Tech Evangelist Robert Nyman. "Identity Bridging keeps the sites a user visits out of the purview of their identity provider. This is one of those rare and wonderful cases where we can improve both usability and security at the same time!"

For now, Identity Bridging works with yahoo.com webmail accounts, but Mozilla will turn on support for other major email providers in coming months.

Beyond the addition of Identity Bridging, Persona 2 loads twice as fast, according to the Mozilla Identity blog. Also, it now includes built-in support for Firefox OS, Mozilla's HTML5-centric platform designed to deliver software as Web apps.

This story, "Mozilla Persona privacy protections trump Facebook in single sign-on ," was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

Join the discussion
Be the first to comment on this article. Our Commenting Policies