Mozilla should move Persona out of the US
Hi, Persona dev here.<p>We want to do better: we want to get rid of the Persona servers altogether. As tlocke said, Persona is designed to let you choose who you trust, and anything that requires centralization is considered a bug.<p>There are 4 points of temporary centralization, each of which can be replaced independently:<p>1. The JS polyfill. Until we stabilize the API, we ask that you link directly to login.persona.org/include.js<p>2. The persona.org interface. Once browsers have native support for Persona, that will supersede both the polyfill and the persona.org interface. This is all based on what Mike Hanson called Locally Isolated Feature Domains (LIFD): <a href="http://www.open-mike.org/entry/lifding-the-web" rel="nofollow">http://www.open-mike.org/entry/lifding-the-web</a><p>3. The Fallback IdP. If your email provider doesn't support Persona, Mozilla will certify your identity after you click a confirmation link sent to your email address. If your email provider <i>does</i> support Persona, it automatically supplants Mozilla's fallback.<p>4. The Hosted Verifier. Until we stabilize the data formats, we recommend that sites POST identity assertions to verifier.login.persona.org/verify for verification. The assertions necessarily contain your email address and the site you're logging into. We want this to go away soon, and François Marier has suggested a pretty slick way to get us there. Until then, we've got a strong privacy policy in place and we limit the data we log. I believe Ben Adida is going to comment more on that shortly.<p>If you're interested in getting involved, drop me a line and I'd be happy to help you get started.