Identity/Firefox Accounts
About Firefox Accounts
Firefox Accounts is the account system that provides access to services run by Mozilla and select partners.
A user can sign in with a Firefox Account to any of her "Foxes" - Firefox on Desktop, Firefox for Android, and Firefox OS - to access integrated services such as Firefox Sync and Firefox Marketplace. She can also sign in to services on the web using a standard OAuth flow.
Longer term we envision that non-Mozilla services and applications will be able to delegate authentication to Firefox Accounts while managing their own data.
For information on integrating a service with Firefox Accounts, visit the Firefox Accounts portal on MDN.
For information on contributing to Firefox Accounts development, visit the developer documentation.
FAQ
Am I required to create a Firefox Account to use Firefox?
No. A Firefox Account is only required for Mozilla Services that require authentication, such as Firefox Sync and advanced features on Firefox Marketplace like purchasing paid apps, adding app reviews etc.
Why does Firefox Accounts require me to choose a password?
One of the primary services that uses Firefox Accounts is Firefox Sync, which encrypts all your data client-side before submitting it to the server. The password is used to securely derive an encryption key.
What information does Firefox Accounts store about the user?
https://developer.mozilla.org/en-US/Firefox_Accounts#Firefox_Accounts_user_data
Can I use Firefox Accounts to store user data for my application or service?
In general no.
Firefox Accounts only stores information that will deliver significant user value across applications or is tightly related to the user's identity. It will not store user data for relying services. Relying Mozilla services can use Firefox Accounts for authentication, but application data storage is the responsibility of the individual applications.
What's the difference between Persona and Firefox Accounts?
Persona is a general-purpose federated login protocol for the web. It is not intended to provide you with a new account, and it's not a new account system. It's intended that you can use Persona to log in to relying sites without first "signing up" for Persona, but rather using an existing account with a Persona-enabled Identity Provider.
One confusing point about Persona today is a service called the "Persona Fallback", which serves as a proxy Identity Provider if your actual IdP doesn't support Persona (or isn't bridged), which just about every IdP except for Google and Yahoo. In this case, you currently have to sign up for a "Persona Fallback Account" (i.e. choose a password and verify your email) to use Persona.
But a Persona Fallback Account is not a Persona Account, it's not part of the long term vision of Persona, and that's not supposed to be the happy path of the Persona login experience. And it's definitely not a Firefox Account.
Independently of Persona, Mozilla needs an account database to deliver a fantastic, integrated experience across all its products and on all the user's devices. Unfortunately, delivering awesome services involves some less exciting, but still important aspects, like making sure users have had a chance to inspect our terms of service and privacy policies. We must also comply with local laws and regulations, e.g., COPPA. It would be inconvenient for users to have to verify a terms of service, a privacy policy, and COPPA at each individual Mozilla service. We believe that users should only have to inspect our terms of service, privacy policy, and go through COPPA verification once for all our services.
We also need more than just a login sysem, e.g. Firefox Sync requires the ability to derive an encryption key to protect the user's data. Firefox Accounts enables us to do that without adding all those complications to the simple-and-effected Persona protocol.
Can I use Persona to log in to my Firefox Account?
No.
Can I use my Firefox Account to log in to non-Mozilla services?
Not initially, but it's something we'd like to support in the future.
Does Firefox Accounts provide email?
No.
Is it possible to host your own Firefox Accounts service, like with Firefox Sync?
Architecture
https://mana.mozilla.org/wiki/display/services/Firefox+Accounts+Architecture
Cloud Services
Firefox Accounts Cloud Services is composed of several sub-services, including an auth server and a content server.
Auth Server
The Auth Server provides an HTTP API that:
- authenticates the user
- enables the user to authenticate to other services via BrowserID assertions
- enables change and reset password operations
Links:
- Code: https://github.com/mozilla/fxa-auth-server
- API documentation: https://github.com/mozilla/fxa-auth-server/blob/master/docs/api.md
- Dev deployment: https://github.com/mozilla/fxa-auth-server#dev-deployment
- Python API client (primarily a reference client): https://github.com/warner/picl-spec-crypto
Content Server
The Content Server hosts static assets (HTML, Javascript, CSS, etc.) that support user interactions with the Firefox Accounts. The responsibilities of the Content Server include:
- hosting a Javascript library that supports interactions with the Auth Server
- hosting login and create account pages
- hosting password reset pages
- hosting landing pages for email verification links
Links:
- Code: https://github.com/mozilla/fxa-content-server
- Deployments:
- dev stable: https://accounts.dev.lcip.org/
- dev latest: https://accounts-latest.dev.lcip.org/
- prod: https://accounts.firefox.com/
JS Client Library
Firefox Accounts provides a Javascript client library for the Web that supports operations with Firefox Accounts. In addition to communicating with the Auth Server, it also performs local key stretching (PBKDF2 and scrypt) on the user's password before it's used in the API. It is hosted by the Content Server. This library was at one time called "Gherkin".
Links:
- Code: https://github.com/mozilla/fxa-js-client
- Key stretching details: https://wiki.mozilla.org/Identity/AttachedServices/KeyServerProtocol#Client-Side_Key_Stretching
- Key stretching performance tests: https://wiki.mozilla.org/Identity/AttachedServices/Key_Stretching_Performance_Tests
Verifier
FxA enables clients to generate BrowserID assertions on behalf of the user. FxA provides a hosted verifier for verifying these assertions.
- Verifier server code: https://github.com/mozilla/browserid-verifier
- Verifier library: https://github.com/mozilla/browserid-local-verify
- Production deployment: https://verifier.accounts.firefox.com/v2
Customs Server
FxA uses the Customs Server to detect and mitigate fraud & abuse.
Links:
- Code: https://github.com/mozilla/fxa-customs-server
- Deployment: currently pulled in by the auth server as an npm dependency
Firefox Accounts on Firefox OS
Implementation of Firefox Accounts in FirefoxOS is committed for b2g v2.0.
Firefox Accounts user story spreadsheet - the canonical source of truth:
The Committed user stories have landed, as have most of the Targeted. The project bug is here:
Open bugs with clear product value:
11 Total; 0 Open (0%); 10 Resolved (90.91%); 1 Verified (9.09%);
Open bugs for corner cases:
| ID | Summary | Priority | Status |
|---|---|---|---|
| 973635 | Allow user to cancel FxA network call when server has sent backoff message | P4 | RESOLVED |
| 994887 | [FxAccounts] Login steps show invalid flow in certain case of logging in from Settings | P4 | RESOLVED |
| 1004209 | Ensure error cases are spec'd, error messages copy approved | P2 | RESOLVED |
3 Total; 0 Open (0%); 3 Resolved (100%); 0 Verified (0%);
Open bugs for refactoring and other yak-shaving:
10 Total; 0 Open (0%); 10 Resolved (100%); 0 Verified (0%);
Deployments
https://developer.mozilla.org/en-US/Firefox_Accounts#Firefox_Accounts_deployments
Metrics
https://wiki.mozilla.org/Identity/Firefox_Accounts/Minimum_Viable_Metrics
Fraud and Abuse
- General Fraud and abuse detection/migitation
- Account lockout feature
Resources
Mailing Lists
- Firefox Accounts development: https://mail.mozilla.org/listinfo/dev-fxacct
- Sync development: https://mail.mozilla.org/listinfo/sync-dev
Team
- Leads: Chris Karlof, Ryan Kelly
- IRC: #fxa
- List: dev-fxacct@mozilla.org
- Engineering: Danny Coates, Shane Tomlinson, Sean McArthur, Vlad Filippov, Phil Booth, Vijay Budhram
- UX: Ryan Feeley
- Metrics: Katie Parlante
- QA: John Morrison, Peter deHaan, Karl Thiessen
- DevOps: Chris Kolosiwsky