I'm sorry about the trouble with Persona -- many people have been reporting issues, and it's unfortunately not been as stable as I would have wanted it to be. I'm looking into whether it's my own implementation (though I followed all the recommended best practices quite closely), or an issue with Persona itself.
EDIT:
It's a known issue with Persona and third party cookies:
https://github.com/mozilla/browserid/issues/1352
Unfortunately, this is a situation where a lot of people on HN probably disable third party cookies (though perhaps a larger percentage of HN readers already have Persona accounts?). Anyway, I'm looking into rolling out my own authentication with email/password soon.
In Show HN: Turn Your Blog Into a Downloadable Ebookmozilla
persona
JavaScript2011–2024
mozilla / persona · Archived
persona
Persona is a secure, distributed, and easy to use identification system.
27Distinct people
46Mentions
0Explicit recommenders
1.8KGitHub stars
What to know before exploring
What it is
Persona is a secure, distributed, and easy to use identification system.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 7:02:26 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year46 dated mentions
Observed mentions: 2011-07-15 00:17:16 UTC to 2024-03-29 15:04:33 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2011 | 2011-01-01 00:00:00 UTC | 2012-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 16 | 0 | 16 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 15 | 0 | 15 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
This repository contains the core Mozilla Persona services.
Persona is a login system based on the BrowserID protocol.
To learn about using Persona on your site, check out our documentation on MDN.
Repository Contents
This repository contains several projects related to Persona:
The Persona Fallback IdP:
A fallback Identity Provider (IdP) for users without native support for Persona via their email provider. Written in node.js, hosted at https://login.persona.org.
The Persona Remote Verification Service:
A stateless node.js server which handles cryptographic verification of identity assertions. Hosted at verifier.login.persona.org, but easy to run locally.
The Cross-Browser Persona Support Library:
The include.js file that provides the navigator.id API for browsers without native support for Persona. This also includes the code for the dialog shown to users of those browsers.
Sample and Test Code:
For all of the above.
Getting Started
The Persona team uses Git and GitHub for all of our development and issue tracking.
If you'd like to contribute code back to us, please do so using a Pull Request.
If you get stuck and need help, you can find the core team on our public mailing list or in #identity on irc.mozilla.org.
Install Dependencies
BrowserID needs the following dependencies before it can run:
node.js (>= 0.8.11)
libgmp3
g++
For detailed instructions for your specific operating system, check out the SETUP docs in the docs/ folder.
Running BrowserID Locally
To run the BrowserID service locally:
Clone the repository to your machine.
Run npm install from the root of your clone.
Run npm start from the root of your clone.
When you run npm start, it will print several URLs to your terminal.
You can test that everything is working by visiting the URL for the example (RP) site.
Look for a line like this in the terminal:
example (10361): running on http://127.0.0.1:10001
You can stop the services by typing Control-C in the terminal.
Staying Up to Date
To stay up to date with BrowserID:
Use git pull to retrieve new changes.
Delete both the var and node_modules folders in the root of your local clone.
Run npm install from the root of your local clone.
Testing
Local testing:
Unit tests can be run by invoking npm test at the top level.
At present, there are three classes of unit tests to be run:
Backend unit tests against a custom, zero-dependency JSON database.
Backend unit tests against MySQL, what we use in production.
Frontend unit tests run headlessly against PhantomJS.
You can control which tests are run using the WHAT_TESTS env var, see scripts/test for details.
Continuous Integration Testing:
Integration tests are done with Travis-CI.
It is recommended that you setup Travis-CI for your BrowserID fork so that tests are automatically run when you push changes.
This will give the BrowserID team confidence that your changes both function correctly and do not cause regressions in other parts of the code.
Configuration files are already included in the repo but some setup is necessary.
Sign in to GitHub
Open Travis-CI
Click "Sign in with GitHub" if you are not signed in. If you are signed in, click on your username then "Profile" and go to step 5.
Click "Allow" if this is your first time signing in.
Find "browserid" in "Your Repositories"
Move the switch from "OFF" to "ON"
Open your fork of BrowserID on GitHub
Click the "Settings" button
Click "Service Hooks" and find the "Travis" Service Hook
Paste in your "Token" which you can find it on your Travis-CI Profile.
Ensure that "Travis" has a green radio button
Push to your fork and return to Travis-CI. Watch the tests run.
LICENSE
All source code here is available under the MPL 2.0 license, unless otherwise indicated.
Read the full README on GitHubWhat Hacker News says
16 sourcesThere are already lots of smart people (Tent, Diaspora, etc.) working on opening up and decentralizing social networking, which is super awesome. The foundation for that future is already being built, and you can help out: https://tent.io/contribute http://diasporaproject.org/get_involved
As for Single-Sign-On, Persona can already take care of that, today, for virtually any domain / browser combo. You can help out on that, too: https://github.com/mozilla/browserid
The future will be even better if the Tent and Diaspora folks make it easy for their servers to also function as Identity Providers for Persona's protocol. FWIW, it seems like there's interest on both sides to make this happen.
In Firefox OS challenges the closed mobile ecosystemsThanks for the feedback!
> 3. Clicking that link provided no further confirmation before changing my password.
Try doing that from another browser :) Persona only skips confirmation if you hit the reset link from the same browser that requested the reset.
Edit: More info at https://github.com/mozilla/browserid/issues/2499#issuecommen...
Which is really interesting, because Persona is doing the right thing, but giving the impression of not doing the right thing. Hm.
In Persona Password Reset Phishing FlawIndeed, you're not the only one confused by this flow, which is why there's an open bug for it: https://github.com/mozilla/browserid/issues/1232
In Persona Password Reset Phishing FlawWe don't have a good path for native apps, yet. There have been a few experiments using Persona in native iOS (Pancake) and Android (Soup) environments, and it apparently works great in PhoneGap apps, if you use the ChildBrowser plugin.
The bug to watch is this one: https://github.com/mozilla/browserid/issues/2034 supporting environments without popups will clear the way for good native SDKs.
In Persona - Mozilla's decentralized and secure authentication systemHi, John, you have some cool ideas there! Hope to see you hacking on Persona. As a member of the team, I just want to clarify that this is not an effort to make firefox alone more secure; it's an effort to make the web more secure. Any browser vendor can implement the protocol, natively or in a plugin, and we hope other browsers will. Same for identity providers. The spec and code are all open-source: https://github.com/mozilla/browserid So Mozilla's strategy remains the same: Put the users of the internet first. That's why we made this.
In Announcing the First Beta Release of PersonaThanks, that's really good feedback.
I've pasted your comments into a bug report: https://github.com/mozilla/browserid/issues/2539
Feel free to jump in if you have ideas on how we can phrase this better.
In Announcing the First Beta Release of PersonaWe'll also be looking into DNS-based delegation for the next beta: https://github.com/mozilla/browserid/issues/1523
In Announcing the First Beta Release of PersonaThe first run on MDN can be a little confusing.
Does it work for you on http://crossword.thetimes.co.uk/ ?
If not, we'd love to help identify your issue
https://github.com/mozilla/browserid/issues/new
In Announcing the First Beta Release of Persona> If someone can truly and effectively solve the password problem, then they have my money.
Mozilla is working on one take on this (Persona), but it's a long, slow slog to develop a good API and get traction with developers, identity providers, and browsers. We'll gladly take your pull requests over your money :) https://github.com/mozilla/browserid
In Logins without logins.Hi Zaroth,
Thank you for the thoughtful post! I'm about to hop on a flight, so this is a bit hasty, but you raise a bunch of good points, and I wanted to thank you for the thoughtful post. I've forwarded this to the Mozilla dev-identity mailing list, and I think it will be helpful as we announce our Beta and polish the service and protocol.
For updates on a few specific points:
> "Teaching users that it’s OK to type their credentials into popups is just crazy."
We agree, and are working on adding native support to Firefox so that users only enter their credentials in the browser chrome, and never in page content. We're also working on a project that will authenticate Gmail, Hotmail, and Yahoo users via OpenID or OAuth, eliminating both the Persona password and the verification email.
Native support should land in Firefox 17 (off by defaul
Read the rest
t), and the provider bridge should go live in 4-6 weeks.
> "The only way I could find to actually clear out my cached credentials from Persona.org was to go back into the Login dialog and click the ‘This is not me’ button."
You can also sign out by going to https://login.persona.org/ and clicking "sign out," but that's not ideal either. Native support in the browser will make this much better. If I recall correctly, we did some user testing earlier this year and found that no matter which option we went with -- logging out everywhere or just logging out of the site at hand -- a very large percentage of users were confused.
Do you have any alternative ideas for approaching this?
> "The Login dialog opened as if an email address should have been listed, but no email was present."
What sort of connection were you on? If I recall correctly, we've seen similar issues when users are on slow connections / high packet loss connections. I've filed a bug to investigate: https://github.com/mozilla/browserid/issues/2090
> "Validation is complicated enough they don’t want sites trying to do it themselves"
The data formats are still in flux while we wait for the IETF to finalize some specs, but if you don't mind keeping your validator up to date, you're totally welcome to do local validation. You can either reuse our validator (writtin in NodeJS), or use PyBrowserID which has experimental support for local validation.
This stuff will stabilize in mid-August when we formally anounce a "Beta" release and commit to API stability, etc. We're almost there! For the working group progress, see http://datatracker.ietf.org/wg/jose/charter/
> "even if a domain does advertise support for BrowserID, that doesn’t exclude certificates from being accepted that are generated by Persona.org."
We're tracking that in Issue #1501: https://github.com/mozilla/browserid/issues/1501
> "Does BrowserID tell you if the user just recently reset their password? No."
Brian Warner has implemented something like this, which invalidates all login.persona.org-backed sessions upon a password change. Pull Request #2026: https://github.com/mozilla/browserid/pull/2026
> "The fact is, when BrowserID says ‘okay’, you don’t have any assurance the person on the other end even knows the user’s password. [...] requiring the website to abdicate all responsibility to a black box that just says ‘okay, let foo in’"
I strongly disagree with this characterization -- for the case of users with native IdP support, you're assured that the user agent successfully authenticated with the email provider within a window of time determined by that provider. For users of our fallback, this is never more than 24 hours, and in the case of public computers, is one hour by default.
That's a much stronger claim than you can make with a traditional password-based system, where a sniffed credential can be valid for months.
Your browser already stores your keys, even with the shim. :)
Faaborg's mockups are awesome, but they're well over a year old and not really guiding our current work. Still, definitely take a look at them, if nothing else than for the cool way of doing mockups!
You can definitely do your own verification without having us in the loop, but we'd urge you to hold off until this fall; the IETF is still standardizing some of the data formats we're using, so the exact serialization of keys and assertions might change between now and then. By using our verifier, you're certain to be up to date.
The easiest way to verify-it-yourself is to just run our code locally; it's all open source, after all :) https://github.com/mozilla/browserid
(PS: The docs are now on MDN, instead of the GitHub wiki: https://developer.mozilla.org/en/BrowserID )
In Introducing Mozilla Persona, An Identity System for the WebIt's hard to explain, but it's not much a "service" - the current implementation is just a "shim", since no browser supports it natively. Client-wise, it's just a JavaScript API. In the future, your browser will store your keys, not Mozilla.
But even with the current implementation it is possible to validate the assertion in your server without contacting browserid.org, but AFAIK nobody did it yet.
(I tried to find a reference for that, but they took it down from their Wiki. It used to say "You may choose to validate assertions on your own server": https://github.com/mozilla/browserid/wiki/How-to-Use-Browser... - the verification code is still online, though)
In Introducing Mozilla Persona, An Identity System for the WebOur translation files were messed up. The fix should enter production on Monday: https://github.com/mozilla/browserid/issues/1905 Thanks!
In Yet Another Sign Up (Why Isn't Open ID More Popular By Now?)Correction:
TL;DR: BrowserID is the protocol, Mozilla Persona is our identity site that (among other things) implements BrowserID.
BrowserID code: https://github.com/mozilla/browserid
"BrowserID will stay as a technology name, but the consumer-facing brand of our service will fall under the Persona brand. You can think about it like this: "Persona ID is an implementation of the BrowserID protocol."" https://groups.google.com/forum/?fromgroups#!topic/mozilla.d...
In Persona: Mozilla's BrowserID ServiceShowing the 15 most recent of 16 sources. Enable JavaScript to search and browse every indexed mention.