Why we won't know Mozilla's Persona

As you might have noticed, if you log in to Media UK, we don't use our own login system. Instead, we log you in through Facebook, Google, and - as of a few weeks ago - LinkedIn.

The benefit of these logins are that they give us access to...

A valid, verified email address
To use Facebook or LinkedIn, you'll want to keep your email address up to date, since both services send you email updates that (generally) you want. With Google, you get an email address with every account, of course. There's no guarantee you use it, of course, but plenty of guarantee that it's still valid. All of these accounts are also verified: that is, you have responded to an email to show it's valid. So we don't need to do that again.

A verifiable 'real name'
No, it might not be your real name; but it's a name that others know you by, and that's what we mean. All three services have a reason for you to use your real name: they're less useful if you don't (and you're also operating outside their terms of service). This is possible to verify programmatically, too, by checks on how many friends you have on each service (and who they are).

A user avatar
All three services normally come with an image, as well. They don't have to. But they normally do. And research shows that people react much better, and in a more civil manner, when they can see human faces.

We don't use Twitter as a log-in, since it doesn't supply email address information; we don't use Microsoft's LiveID since the service doesn't encourage real names; and we don't use Persona because of more fundemental issues.

Persona has no real names, nor user avatars. So it's already out. But it also fails on a more fundemental reason: its use of email addresses as login names.

First, there's no reason to keep the email address that you use for Persona actually active, since it itself operates no services that make that useful. So, if we used it, we'd potentially fall foul of ISP spam rules (since we can't tell whether the email is still actually active); and we'd fall foul of the Data Protection Act (which requires us to keep our information up to date).

Second, there's no way of changing your email address using Persona as far as I can see. In the past, I left Virgin Radio (as james.cridland@virginradio.co.uk) and went to work at the BBC (as james.cridland@bbc.co.uk). Had I used my work email address for any login, I couldn't simply have changed my email address: a Persona-powered website would treat me as a brand new person. All my other data either lost, or unusuable since I'd no longer get email alerts.

We're always open to other sign-on services - as long as we get enough data from them. Persona, however, appears to me to be fatally flawed.