1. Jean-Yves Perrier (Mozilla) / May 12th, 2012
@teoli2003
MDN Hack Day — London
Persona / BrowserID
Proving your identity without giving up
your privacy.

4. Multidevice but only
Firefox
Consequence : Must be
platform independant

5. Hey ! We have these !

8. Is this an identity ?

9. For the user :
Secure
Simple to use
Single sign-on : one password
Respect privacy
Independant of the browser
Independant of the device
Feel as a real identity

10. Hashing
MD5 — SHA1 — SHA128 ?
Salting
Ensuring strong password
usage
Procedures
- initial authentication
- password lost
- disaster recovery
- keeping up with the algo

11. For the site :
Secure
Simple to use
Respect privacy (no 3rd party take the
customer relation)
Independant of the browser
Independant of the device
Feel as a real identity
Less maintenance burden

12. Introducing Persona
and BrowserID
BrowserID : the protocol
Persona : its incarnation in the Mozilla products

13. The BrowserID
protocol
Provide authentification
Secure
Doesn't leak any more
information

14. Identity = e-mail
address
It is a fully distributed system with billions of accounts
across countless host providers
Users understand what an email address is and what it
represents
It naturally allows for the use pseudonyms
It relies on the distributed Domain Name System
(DNS) for name lookup

15. The actors
Relying Party
a site or service that depends on a federated identity
provider
Identity Provider
a site or service that provides identity assertions for
3rd party consumption
User

16. Step 0. Registration
with the Identity
Provider

22. Step 1. User certificate
provisioning

24. Step 2.Assertion
generation and
verification

26. The code...

27. Client-side

28. Server-side
In the future, libraries will be provided allowing this to be
done on the server.

29. What's next ?

30. Links/Docs
News about Persona : http://identity.mozilla.com/
The MDN entry point : https://developer.mozilla.org/en/BrowserID
Client-side code : https://developer.mozilla.org/en/BrowserID/Quick_Setup
Server-side code : https://developer.mozilla.org/en/BrowserID/Remote_Verification_API
Numerous CMS/servers integration done :
https://github.com/mozilla/browserid/wiki/BrowserID-Libraries
Examples : https://github.com/mozilla/browserid-cookbook
Security tips : https://developer.mozilla.org/en/BrowserID/Security_Considerations

31. Q&A

32. Thanks for the
attention