The problem with passwords on the web and what to do about it

Handling user passwords safely is hard, but replacing passwords on the web in a reasonable way is even harder. Really, this should have been in the browser all along. This is where Persona comes in.

Transcript

1. François Marier – @fmarier The problem with passwords on the web and what to do about it
2. passwords
3. problem #1: passwords are hard to secure
14. bcrypt / scrypt / pbkdf2 per-user salt site secret password & lockout policies secure recovery
15. bcrypt / scrypt / pbkdf2 per-user salt site secret password & lockout policies secure recovery
16. bcrypt / scrypt / pbkdf2 per-user salt site secret password & lockout policies secure recovery
17. bcrypt / scrypt / pbkdf2 per-user salt site secret password & lockout policies secure recovery
18. bcrypt / scrypt / pbkdf2 per-user salt site secret password & lockout policies secure recovery
19. bcrypt / scrypt / pbkdf2 per-user salt site secret password & lockout policies secure recovery 2013 2013 password password guidelines guidelines
20. passwords are hard to secure they are a liability
21. ALTER TABLE user DROP COLUMN password;
22. problem #2: passwords are hard to remember
25. pick an easy password
26. pick an easy password use it everywhere
27. passwords are hard to remember they need to be reset
29. control email account control all accounts =
30. social login
31. “People want a little dating before marriage.” Eric Vishria – Rockmelt
33. decentralized
34. myid.com/u/francois
37. privacy ®
38. existing login systems are not good enough
39. ideal web-wide identity system
40. • decentralized • simple • cross-browser ideal web-wide identity system
41. • decentralized • simple • cross-browser ideal web-wide identity system
42. • decentralized • simple • cross-browser ideal web-wide identity system
43. • decentralized • simple • cross-browser
44. how does it work?
45. fmarier@gmail.com
46. demo #1: http://crossword.thetimes.co.uk/ fmariertest@eyedee.me
47. Persona is already a decentralized system
48. decentralization is the answer, but it's not a product adoption strategy
49. we can't wait for all domains to adopt Persona
50. we can't wait for all domains to adopt Persona solution: a temporary centralized fallback
51. demo #2: http://sloblog.io/ fmariertest@gmail.com
52. Persona already works with all email domains
53. identity bridging
54. demo #3: http://www.reasonwell.com/ fmariertest@yahoo.com
58. Persona supports all modern browsers >= 8
59. Persona is decentralized, simple and cross-browser
60. it's simple for users, but is it also simple for developers?
61. 1. load javascript library
62. 1. load javascript library 2. setup login & logout callbacks
63. 1. load javascript library 2. setup login & logout callbacks 3. add login and logout buttons
64. 1. load javascript library 2. setup login & logout callbacks 3. add login and logout buttons 4. verify proof of ownership
65. you can add support for Persona in four easy steps
66. one simple request
68. building a new site: default to Persona
69. working on an existing site/app: add support for Persona
70. Friday office hours
71. we need your help to eliminate site-specific passwords
72. To learn more about Persona: https://login.persona.org/ http://identity.mozilla.com/ https://developer.mozilla.org/docs/Persona/Why_Persona https://developer.mozilla.org/docs/Persona/Quick_Setup https://github.com/mozilla/browserid-cookbook https://developer.mozilla.org/docs/Persona/Libraries_and_plugins http://123done.org/ https://wiki.mozilla.org/Identity#Get_Involved @fmarier http://fmarier.org
73. identity provider API https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" }
74. https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" } identity provider API
75. https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" } identity provider API
76. https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" } identity provider API
77. https://eyedee.me/.well-known/browserid: { "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html" } identity provider API
78. identity provider API 1. check for your /.well-known/browserid 2. try the provisioning endpoint 3. show the authentication page 4. call the provisioning endpoint again
79. identity provider API 1. check for your /.well-known/browserid 2. try the provisioning endpoint 3. show the authentication page 4. call the provisioning endpoint again
80. identity provider API 1. check for your /.well-known/browserid 2. try the provisioning endpoint 3. show the authentication page 4. call the provisioning endpoint again
81. identity provider API 1. check for your /.well-known/browserid 2. try the provisioning endpoint 3. show the authentication page 4. call the provisioning endpoint again
82. © 2013 François Marier <francois@mozilla.com> This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 New Zealand License. Hotel doorman: https://secure.flickr.com/photos/wildlife_encounters/8024166802/ Top 500 passwords: http://xato.net/passwords/more-top-worst-passwords/ Parchment: https://secure.flickr.com/photos/27613359@N03/6750396225/ Uncle Sam: https://secure.flickr.com/photos/donkeyhotey/5666065982/ Restaurant dinner: https://secure.flickr.com/photos/yourdon/3977084094/ Stop sign: https://secure.flickr.com/photos/artbystevejohnson/6673406227/ Photo credits: