Passwords and freedom: can we lose the former and retain the latter?

Passwords are a big problem online and a lot of websites have turned to centralized services to handle logins for them. It’s a disturbing trend from a privacy/surveillance point of view, but from a software freedom point of view, it’s also turning these proprietary services into core dependencies.

That’s why Mozilla is building Persona, a new federated and cross-browser system which makes identity a standard part of the browser. It’s simple, privacy-sensitive and entirely libre software.

This talk will explore the challenges of the existing Web identity solutions and introduce the choices that were made during the development of Persona.

Identity is a very significant piece of Internet infrastructure and so it’s critical that the solution that gets widely adopted be free-as-in-freedom, decentralized and ruthlessly focused on making it easy for developers and end-users.

Transcript

1. François Marier – @fmarier passwords and freedom: can we lose the former and retain the latter?
2. passwords
3. problem #1: passwords are hard to secure
14. passwords are hard to secure they are a liability
15. ALTER TABLE user DROP COLUMN password;
16. problem #2: passwords are hard to remember
17. pick an easy password
18. pick an easy password use it everywhere
21. decentralized
22. privacy ®
23. existing login systems are not good enough
24. ideal web-wide identity system
25. • decentralized • simple • cross-browser ideal web-wide identity system
26. • decentralized • simple • cross-browser ideal web-wide identity system
27. • decentralized • simple • cross-browser ideal web-wide identity system
28. • decentralized • simple • cross-browser
29. how does it work?
30. fmarier@gmail.com
32. demo #1: http://crossword.thetimes.co.uk/ fmariertest@eyedee.me
33. Persona is already a decentralized system
34. decentralization is the answer, but it's not a product adoption strategy
35. we can't wait for all domains to adopt Persona
36. we can't wait for all domains to adopt Persona solution: a temporary centralized fallback
37. demo #2: http://sloblog.io fmariertest@gmail.com
38. Persona already works with all email domains
39. identity bridging
40. demo #3: http://www.reasonwell.com/ fmariertest@yahoo.com
44. Persona supports all modern browsers >= 8
45. Persona is decentralized, simple and cross-browser
46. it's simple for users, but is it also simple for developers?
48. <script src=”https://login.persona.org/include.js”> </script> </body></html>
49. navigator.id.watch({ loggedInEmail: “francois@mozilla.com”, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { // do something } ); }, onlogout: function () { window.location = '/logout'; } });
50. navigator.id.watch({ loggedInUser: “francois@mozilla.com”, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { // do something } ); }, onlogout: function () { window.location = '/logout'; } });
51. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { // do something } ); }, onlogout: function () { window.location = '/logout'; } });
52. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { // do something } ); }, onlogout: function () { window.location = '/logout'; } });
53. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { window.location = '/'; } ); }, onlogout: function () { window.location = '/logout'; } });
55. navigator.id.request()
59. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { window.location = '/'; } ); }, onlogout: function () { window.location = '/logout'; } });
60. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { window.location = '/home'; } ); }, onlogout: function () { window.location = '/logout'; } });
61. $ curl -d "assertion=<ASSERTION>& audience=http://123done.org" https://verifier.login.persona.org/verify
62. $ curl -d "assertion=<ASSERTION>& audience=http://123done.org" https://verifier.login.persona.org/verify
63. { status: “okay”, audience: “http://123done.org”, expires: 1344849682560, email: “francois@mozilla.com”, issuer: “login.persona.org” }
64. { status: “failed”, reason: “assertion has expired” }
68. navigator.id.logout()
69. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { window.location = '/home'; } ); }, onlogout: function () { window.location = '/logout'; } });
71. 1. load javascript library
72. 1. load javascript library 2. setup login & logout callbacks
73. 1. load javascript library 2. setup login & logout callbacks 3. add login and logout buttons
74. 1. load javascript library 2. setup login & logout callbacks 3. add login and logout buttons 4. verify proof of ownership
75. you can add support for Persona in four easy steps
76. one simple request
78. building a new site: default to Persona
79. working on an existing site/app: add support for Persona
80. To learn more about Persona: https://login.persona.org/ http://identity.mozilla.com/ https://developer.mozilla.org/docs/Persona/Why_Persona https://developer.mozilla.org/docs/Persona/Quick_Setup https://github.com/mozilla/browserid-cookbook https://developer.mozilla.org/docs/Persona/Libraries_and_plugins http://123done.org/ https://wiki.mozilla.org/Identity#Get_Involved @fmarier http://fmarier.org
81. identity provider API https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" }
82. https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" } identity provider API
83. https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" } identity provider API
84. https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" } identity provider API
85. https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" } identity provider API
86. identity provider API 1. check for your /.well-known/browserid 2. try the provisioning endpoint 3. show the authentication page 4. call the provisioning endpoint again
87. identity provider API 1. check for your /.well-known/browserid 2. try the provisioning endpoint 3. show the authentication page 4. call the provisioning endpoint again
88. identity provider API 1. check for your /.well-known/browserid 2. try the provisioning endpoint 3. show the authentication page 4. call the provisioning endpoint again
89. identity provider API 1. check for your /.well-known/browserid 2. try the provisioning endpoint 3. show the authentication page 4. call the provisioning endpoint again
90. © 2013 François Marier <francois@mozilla.com> This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 New Zealand License. Hotel doorman: https://secure.flickr.com/photos/wildlife_encounters/8024166802/ Top 500 passwords: http://xato.net/passwords/more-top-worst-passwords/ Parchment: https://secure.flickr.com/photos/27613359@N03/6750396225/ Stop sign: https://secure.flickr.com/photos/artbystevejohnson/6673406227/ Photo credits: