Mozilla has unveiled a new distributed online identity system dubbed Mozilla Persona. The new Persona project is Mozilla’s latest effort to tackle online identity management by shifting the focus from individual websites to the web browser.
Mozilla has been playing with the idea of a browser-based identity manager for quite some time. In 2010 the company launched its Account Manager project, though it failed to gain much traction and was later scrapped.
More recently Mozilla has been working on Browser ID, a similar effort to move the process of managing passwords and online identities to the browser, rather than relying on any particular website’s login process. The Browser ID project offers developers a means of creating a browser-based login system for their sites. The code is available through GitHub and while using it is considerably simpler than similar efforts like OAuth, Browser ID has yet to catch on with many sites.
Mozilla Persona will build on Browser ID’s foundation (Browser ID will continue to be the name of the developer-facing aspect of the protocol), but add in more end user features like “an identity dashboard.” As with Browser ID, Persona will face a chicken and egg problem — why bother supporting Persona when few people are using it, and why bother using it when so few sites support it?
Thus far, aside from the proposed dashboard, Mozilla’s goals for Persona are only vaguely outlined. The closest Mozilla comes to giving it a concrete definition is to say that Persona will consist of “a collection of components and experiences we’re designing to manage the whole of a user’s online identity.”
If you’ve got ideas or opinions about what Persona ought to offer, you can let Mozilla know your thoughts via the mailing list or through Twitter using the #browserid or #mozpersona hash-tags.
For those wondering about the old Personas, the toolbar background images that can be applied to Firefox, fear not, they remain available and Mozilla is already on the hunt for a more fitting name.
While the new header is just a proposal at the moment, Mozilla already has some code ready and is considering adding the feature to future versions of Firefox. The current plan is to create a new preferences option that would allow you to opt-out from tracking. Check the box in the preferences and Firefox will start sending the do-not-track header each time you request a new page.
Interestingly, the header Mozilla proposes is not the same as the “X-Do-Not-Track” proposal, which is already implemented in Firefox add-ons NoScript and Adblock Plus. For more details on how Mozilla’s new HTTP header will work, see Mozilla developer Sid Stamm’s blog post.
Like Mozilla’s proposed privacy icons, the problem with the new header is getting third-party ad sites to obey it. Mozilla calls it a “chicken and egg” problem and hopes to jumpstart the idea by including the header in future releases of Firefox. At that point it would be up to third party websites to support the header and, as Mozilla puts it, “honor people’s privacy choices.”
Mozilla has taken the lead among browser vendors to make a site’s privacy settings more explicitly visible. It’s doing so by proposing visual cues in the browser that indicate what level of privacy you’re currently browsing at, and what pieces of your personal data the site you’re currently visiting is sharing with the rest of the web.
The idea behind Raskin’s proposal is that the browser is the most logical place to display identity and privacy information to the user as they click around on the social web. The end goal is to produce a set for warnings similar to the way that Firefox (and other browsers) currently handle phishing attack warnings, using visual icons and simple language to explain what you’re getting into when you load a page with a different level of privacy or security.
For the active social web user, keeping track of which bits of your data are public and which are private on different sites is a chore. Some websites share your photos, status updates, your list of friends, who you’re following and other data default. Some share nothing. The rest are somewhere in the middle.
Part of the problem is the privacy policies themselves. They are complex, mind-numbingly long legal documents. We routinely ignore them, breezing past them by clicking “I agree.” Once clicked, your rights are compromised, and you may not be able to fully restore them.
A set of icons in the browser, to quickly and easily allow users to know what will happen to their data, means that users don’t need a law degree to know what’s happening to their images, status updates and other data.
The big difference between privacy icons and the phishing warnings your browser already offers, is that these icons are targeted at the websites themselves. The biggest counter-argument to Raskin’s proposal is that there’s nothing stopping a site from displaying these icons and then doing the opposite.
In other words, sites using the icons maliciously would face legal consequences. Of course differences in international laws mean enforcing such violations would be complex.
Still, as Raskin points out, privacy policies are fast becoming a selling point for many sites. Nearly every site we’ve tested lately has some sort of large, obvious banner that proudly proclaims the site will never share your data. Those are the kinds of sites, says Raskin, that would adopt privacy icons.
But it’s still unlikely any site would ever adopt the negative icons. If you’re sharing everything users give you with anyone who pays for it, you probably don’t want to advertise that. So the privacy icons actually become most useful when they aren’t present. Of course, as Raskin writes, “people don’t generally don’t notice an absence; just a presence.”
The solution to that problem is to make the privacy icons machine readable. The workflow would be something like this: You visit a website and decide to sign up. When Firefox encounters the sign-up form, it looks for the privacy icon. If it finds it, Firefox displays it. If Firefox doesn’t see an icon it warns you that your information may be shared using the negative icon. Either way, you know where you stand.
The rumor mill has been buzzing for months about the imminent arrival of a new “Facebook browser” called RockMelt.
Well, it really does exist, and it’s here. RockMelt is being released as a limited public beta Sunday. Anyone can sign up to test it out, but the release will be throttled so as not to overload the cloud-based components of the app. RockMelt will be doling out download links as quickly as it can manage on a first-come, first-served basis.
The two founders, CEO Eric Vishria and CTO Tim Howes, demonstrated RockMelt to Wired a few days before Sunday’s launch.
It’s based on Chromium, so it inherits Google Chrome’s speed, looks, and basic functionality on both Mac and Windows.
And while its Facebook integration runs deep, RockMelt is not exactly a Facebook browser. It’s a social web browser, allowing you to post links, videos and status updates to both Facebook and Twitter (that’s it for now, but more services will be added later). There are also built-in clients for consuming your Facebook feed and managing multiple Twitter feeds, a chat client, and lightweight RSS reader. It does use your Facebook account to personalize the experience, but its reach is broader than just Facebook.
We’ve seen browsers custom-built for the social web before, most notably Flock, which launched as a MySpaced-up version of Firefox. Mozilla experimented with Ubiquity, an in-browser tool for posting to different social sites and interacting with web services. There are a number of add-ons that can embed social networking dashboards into the browser for you. These tools have grown in popularity as we’ve struggled to manage the ever-increasing flow of links, media and bits shared by our online friends.
So, the idea isn’t original. And RockMelt doesn’t sport a complete re-invention of the browser interface, either. But it is very streamlined, and there are some key elements that people who live and breathe the social web will find intriguing.
Mozilla has an answer to site-centric identity systems like Facebook’s — put the browser in charge of your online logins instead.
The Mozilla Labs project called Account Manager has graduated from Labs and will soon be making its way into Firefox proper.
Account Manager allows you to log in and out of websites directly through the browser, rather than relying on a particular site’s login form. Using a new menu item in the main toolbar — a button with a picture of a key that sits next to the address field — Account Manager lets you pick a login to use at any site you visit. It stores logins you’ve already created, suggesting them whenever they can be used. It can also generate (and remember) random passwords to make your logins more secure. It’s a radical step up from Firefox’s current Password Manager feature.
Mozilla’s decision to put this new button directly into Firefox’s toolbar brings us one step closer to realizing a ubiquitous social network on the web, where you’re logged in and connected to your friends wherever you go. All the while, you remain in total control of your own identity since you can tinker with all of your logins and connections through some simple panels in the browser.
There’s no word yet on when this will make it into Firefox, but we may see it as soon as Firefox 4, which is due in early 2011. For now, Account Manager is separate add-on you can grab from the Mozilla website. The add-on is still a beta release and there are some known bugs, but in our testing, it performed as advertised.
At the moment, Account Manager works with Google, Yahoo, Facebook and several Mozilla sites. Mozilla is planning to add support for other authentication systems, including OpenID, in the near future. The post on Mozilla Hacks also has instructions for site owners that let them add support for Account Manager with “only 15 minutes of hacking,” though we suspect it will become easier to implement support once the spec is fully formed.