The centralized persona.org service seemed like the weakest link in an otherwise interesting distributed authentication system; persona.org gave people a &quot;transitional&quot; way to associate logins with email addresses rather than federated IDs, but as far as I can tell, nobody ever used anything else.  It makes me sad that Mozilla never followed through with the browser integration component of BrowserID.<p>Consider this for a browser-integrated login system:<p>- Browsers directly provide an API for sites to say they need to say &quot;this site wants an account&quot;.<p>- When the browser sees such a request from an origin that the user doesn&#x27;t have an account for, it provides browser UI to create an account and log in.  Creating an account creates an origin-specific keypair in the browser and hands the site the public key; logging in uses a challenge-response protocol to prove ownership of the private key.<p>- When the browser sees such a request from a site the user has an account for, it provides browser UI to log in via the challenge-response protocol; that same browser UI can offer options like &quot;keep me logged in&quot;.<p>- Both Firefox and Chrome have cross-system synchronization systems (e.g. Firefox Accounts&#x2F;Sync), including to mobile browsers.  Use those systems to sync the keypair across browsers controlled by the same user.  Perhaps offer options to copy individual keypairs via QR code or similar, for the much smaller set of people who have systems of varying trust levels that should each have access to overlapping subsets of accounts.<p>- The browser can (at the user&#x27;s option) provide an email address to a site.  The site can (at the site&#x27;s option) provide an option to register a new key for that email address, as the equivalent of a &quot;lost my password&quot; system but for &quot;lost my computer or browser profile&quot;.<p>This implementation seems quite straightforward.  About the only problem I know of that it <i>doesn&#x27;t</i> solve involves throwaway accounts with memorized passwords used only with private browsing, where people don&#x27;t want to leave a trace.  If people care enough about that case, perhaps offer the option (such as when using private browsing) to compute a key from the origin, the user&#x27;s email address, and an optional password, and throw it away at the end of the session.  (For that matter, browsers could generate a completely transient key, for those times when you want to make a throwaway account that you&#x27;ll never want access to again unless the site has an email-based recovery option.)<p>While this system provides some useful properties for highly technical users, it seems quite feasible to present it in an extremely simple manner for novice users.