On: Why is nobody using SSL client certificates?

[wmf]

I see Persona as the next generation of client certs with usable UX. People are working on this problem, just not within SSL/TLS this time.

[h8trswana8 → wmf]

Sure, if you like your password going through Mozilla's server unencrypted.

[wmf → h8trswana8]

Then don't use Mozilla's server.

(There's a tough choice here: Persona's crutches make it much easier to deploy incrementally, but there's no incentive to ever get off the crutches and people think that the crutches are Persona.)

[steveklabnik → h8trswana8]

BrowserID requires nothing from Mozilla. They of course offer a public server so that you don't have to run your own server if you don't want to, but it's entirely, 100% optional.