Identity

Get Involved

Reach out to us

• on IRC at irc.mozilla.org, #identity
• on our mailing list
• by tuning in to our short weekly meetings

Learn more about Persona

• Documentation
• Specification
• Bug tracker

Follow us on

• our blog
• Twitter or Identica
• our announcement list

Help us out by

• hacking on the code
• writing a plugin or a library
• spreading the word
• translating Persona in your language

Vision

Central to a people-centered ecosystem is an identity system that is under the control of the individual, and enables information sharing on the users own terms with no take-it-or-leave-it policies. To this end, Mozilla is building an identity system for the Web that has these properties.

The first service we're building, Persona, enables users to easily sign into websites using their existing email address in a secure and privacy-protecting way, with no additional passwords. For developers, it offers a very easy to implement API, and a verified email address they can use to communicate with the user.

User identities encompass much more than just an email address, of course, and so the next components of the Mozilla identity system will include payments, profile and data sharing on the users terms and more.

Identity Design Principles

draft 01 APR 2013

Relationship (like a doorman) not mechanism (like a lock) We've used the metaphor of a lock and key for passwords. This is too cold and impersonal. It is an abstraction that serves the cold metal of hardware, but does nothing to help you build a relationship with the person. An account allows a computer to recall this person, much like a doorman who can recognize a familiar face and recall their shared history to have a meaningful conversation. HIERARCHY OF NEEDS Reliability I want access to my information 100% of the time, wherever I am. And don't blame me for unreliable service! The service should be percieved to be reliable.

• Can access when and where needed.
• Data is safe from unintentional loss.
• In-browser password manager is allowed to function normally, not disabled.

Safety

At all points of centralization, the service should be resistant to attack. The service should be perceived as secure/protected.

• Passwords stored securely.
• If I lose my device and attacker cannot remotely wipe another machine.
• Information from one account cannot be used to hack another site

Proportionality

The approach you use should be appropriate to the threat.

• Password character requirements should be reasonable. Don't ask for 72chars, capital + number that rotates every 90 days unless you are a high-risk target.
• Keep user logged in for long sessions unless you are a high-risk target.

Creating a supportive environment

Don't treat me as an intruder in my own house. Tone should be human and recognize that remembering credentials is a difficult thing to do. Be polite and forgiving of imperfect memory.

• Error messages should have positive tone. Shaming language around forgetting password only create unnecessary stress.
• After login it redirect user to where there intended to go.
• Remember my configurations.
• Clear how to access self help documents and forums.

Be the user's trusted agent

Provide a safe and secure way to take your information around the web

• Easy access to contacts, contents of your "wallet."

Responsibilities of Relying Party sites

There are several issues which are directly related to accounts which are outside the scope of Persona. These are guidelines for relying party sites implementing Persona.

• Site reflects whether the user is logged in or not.
• Rules are clear when and why I need to login or out
• Usernames should only be used if you have public-facing content that needs to be anonymous.
• Site has clear policies about who has access to and who owns user data.
• Site employs ethical practices around what they do with user data and data porability.
• Changes to terms and privacy policies are presented with clear language.

2013 Identity Goals

• Sign into websites
• PiCL (a.k.a. Profile In the Cloud)
  • PiCL is pronounced 'pickle'
  • Details on this project can be viewed on the Attached Services page.
  • Demos are posted regularly on the Attached Services page.
• Native sign into websites & apps (FxOS, FxDesktop, FxAndroid, and others)
  • Work targeted to begin Q2

2013 Projects and Roadmap

Firefox OS

Milestones	Overview	Target	Crew	Status
Ongoing support	Scheduled work has been completed on schedule. We are in support mode at present.	Completed Q4 2012	Jed (Lead), Austin, Zach, Sean	ongoing
Merge Persona code base into main dev branch	Bugzilla Tracking Number	Q1	Jed, Lloyd	In Progress

Profile in the Cloud (PiCL)

Milestones	Overview	Target	Crew	Status
[Attached Services]	When a user logs into the browser using a Persona identity, they likely want to connect a number of services, including passwords, bookmarks and tabs backup, contacts in the cloud, apps, etc. The PiCL project will be publishing updates on a regular basis. Details on our milestone schedule can be viewed at: PiCL engineering milestones		Ben (Project Lead), Jed (Contacts Lead), Chris K (Password Lead), Crystal (UX), Brian W, Ryan K, Dan W, Sean, Zach
Milestone 1A:	native Persona login in FX desktop build (could this be an add-on?), first build of Android "Sync Provider", servers functional with client-side tests for 2 data-types	March 1		Done
Milestone 1B:	desktop: log in with actual Persona assertions, read/write bookmarks, read/write passwords, desktop: full outgoing queues on all data types, ingoing queue with strategy for no-cycles :), android:, read/write two data types with fake auth , comparison of data storage mechanisms for different datatypes (class A, A+ and keyserver)., automation of server deployment and scaling: first pass, warner's advanced data-sync model - unit tests for whole-collection diffs, Nightly with native Persona	March 8		In Progress
Milestone 1C:	desktop: access tabs from other machines, desktop: full incoming/outgoing queues with client-side rebasing, android: read/write two datatypes with actual Persona assertions, servers: data class A+ model with real keyserver.	March 15		Not Started
Milestone 1D:	desktop: history, desktop: queue integration, android: 3-4 data types.	March 22		Not Started
Milestone 1E:	desktop alpha add-on ready for internal demonstrations, android alpha app ready for internal demonstrations, server architecture on AWS with scale metrics and initial auto-scale strategy.	March 29		Not Started

Signin to Web

Project	Overview	Target	Crew	Status
Train Schedule	Details on our train schedule is live and on demand		Lloyd (Project Lead), Francois, Shane, Dan C, Jared, Gene	Ongoing
Persona Beta 2	Details on the Beta 2 announcement can be viewed at: Beta 2 Announcement Task List	Q1 Goal	Dan C, Ben, Tauni, Lloyd	In Progress
Big Tent		Q1 Goal	Austin, Gene, Lloyd	In Progress
KPI		Q1 Goal	Katie, Gene, Lloyd	In Progress
AWS		Q1 Goal	Jared, Gene	In Progress

Identity Speaks: Upcoming Conference Schedule

Conference	Presentation Details	Date	Location	Presenter
HTML5mtl	Présentation du système Persona	Mar 26, 2013	Montréal, Canada	Francois Marier
AusCERT	Securing the Web without site-specific passwords	May 24, 2013	Gold Coast, Australia	Francois Marier

• Adding a talk? Don't forget to add it to the Mozilla Events Calendar too.
• Removing a talk? Please move it to Identity/Spread Persona.

Meet the Identity Team

Name	Title	Location
Ben Adida	Director	California
Austin King	Developer	Washington
Brian Warner	Developer	California
Chris Karlof	Developer	California
Crystal Beasley	Lead UX Designer	Oregon
Dan Callahan	Developer Relations and Documentation	Minnesota
Edwin Wong	QA	California
Francois Marier	Developer	New Zealand
Gene Wood	Operations	California
James Bonacci	QA	California
Jared Hirsch	Developer	California
Jed Parsons	Developer	California
John Morrison	QA	California
Karl Thiessen	QA	California
Katie Parlante	Developer	California
Lloyd Hilaiel	Lead Developer	Colorado
Ryan Kelly	Developer	Australia
Sean McArthur	Developer	California
Shane Tomlinson	Developer	United Kingdom
Tauni Oxborrow	Program Manager	California
Zach Carter	Developer	California

Archive: Quarterly Goals and Project Summary

2013 Q1 Goals Project Description Status Contact [FFOS] FXOS Identity Service in production [Desktop, Android] PICL (Profile In Cloud) alpha1 add-on for Firefox and FX Android (Sync replacement) [Special] Persona Sign-In Beta 2 [FFOS, Desktop, Android] Persona Service one data-center deployed on AWS [FFOS, Desktop, Android] Improved Metrics [Special] Mozilla IdP [STRETCH] 2012 Q4 Goals Project Description Status Contact B2G Identity Integration [DONE] native identity client code landed in Gecko and Gaia [DONE] server-provided dialog, re-branded and integration tested [DONE] deployment plan finalized [DONE] performance optimizations for slow connections [DONE] [STRETCH] unverified email support Completed Ben Adida Continuous Improvement of Persona Service: [DONE] Proxy IdP [MISSED] Improved Metrics [DONE] Improved QA Automation [DONE] Scaling plan Team Signin Design and Prototyping of Significant New Persona Features: [DONE] Persona Password Manager pre-alpha release - delayed one week into Q1 because of holidays, but otherwise done, so marking it as such. [MISSED] [STRETCH] Native Mobile SDKs 2012 Q4 Project Summary Project Description Status Notes Gombot On-Hold Post-Mortem Notes can be reviewed at: Force Page Refresh Archived front page Features on ice (or dropped): Old / Archived Mozilla Identity Roadmap Owner: Dan Mills Updated: 2013-04-1 Our goal is to provide to users convenient, safe, and open identity solutions that can become standard components of the Web, while working out-of-the-box as well as we can make them to. In 2012, we will expand our user-centered identity platform beyond sign-in to also include connecting with sites and people as well as online payments. Name Description Status When Who Key-wrapping Support for key wrapping and wrapped key storage. This allows other sites to encrypt data with a key that is unlocked (locally) with the user's BrowserID password. Designing & planning Q1 Ben Adida navigator.id.share() prototype Developer API to allow users to easily share content with others Not started Prototype in Q2 Dan Mills Remote storage API prototype Developer API to store data (files) in the user's preferred storage provider Not started Prototype in Q3 Dan Mills API to me Developer API to access extended profile data for the user Not started Prototype in Q3 Dan Mills