seanmonstar

This is already the case. For browsers that use the shim, the certificate is stored in localStorage on the login.persona.org domain, and then given to the website you're trying to login to.

Comment · 13 years ago

Whichever technology you want to use is fine. You need to publish 3 routes: /.well-known/browserid, an auth route, and a provision route.

The auth and provision routes need to be HTML pages that authenticate you however you want, and then sign a certificate with your key that you publish the .well-known file.

Here's how we did it for Gmail: https://github.com/mozilla/browserid-sideshow/blob/master/bi...

Comment · 13 years ago

In short: easier to implement, everyone has an email address, improved privacy. OpenID tells the provider every time you log in to any website, Persona does not.

https://developer.mozilla.org/en-US/docs/Mozilla/Persona/Why...

Console.log() all the things seanmonstar.com

10 seanmonstar 13 years ago 1 comments

Comment · 13 years ago

Actually, the the verifier (verifier.login.persona.org) runs code that could be run on any server. It _does_ check Gmail for the well-known file first, and then, since not found, uses the fallback of login.persona.org.

As soon as Gmail (or any id provider) implements a well-known file, the verifier will immediately use that instead.

And the script that does all this _could_ be run on your own server. The only reason we don't quite yet tell people to do that is to be absolutely sure the verifier is correct in every step. It's harder to get everyone to upgrade their own server, so while in beta, we offer the verifier.