The Web beyond "usernames & passwords" (OSDC12)

Identity systems on the Web are a bit of a mess. Surely in 2012, we would have something else than usernames and passwords for logging into websites. A solution that doesn't require trusting a central authority with a privacy policy that can change at a whim.

It turns out that solving the general identity problem is very hard. Some of these solutions require complicated redirections, an overwhelming amount of jargon and lots of verbose XML. The technology has been around for a long time, but implementing it properly (and safely) is often incredibly difficult. It's a lot to ask of the millions of part-time developers out there that are building sites out of some quick HTML, a MySQL database and some PHP Code samples.

This talk will explore the challenges of the existing Web identity solutions and introduce the choices that we made during the development of Persona, a new Open Source federated identity solution from Mozilla, designed and built to respect user privacy.

Transcript

1. François Marier – @fmarier T h e W e b b e y o n d “Usernames & Passwords”
2. Username: francois Password: **************** X Sign in
3. security
10. bcrypt
11. bcrypt per-user salt
12. bcrypt per-user salt site secret
13. bcrypt per-user salt site secret password & lockout policies
14. bcrypt per-user salt site secret password & lockout policies secure recovery
15. bcrypt per-user salt site secret password & lockout policies secure recovery 2012 2012 password password guidelines guidelines
17. conversion rate
18. # hits signup
19. # hits signup signup_complete
20. # hits signup signup_complete l o s t cust- omers
21. existing solutions
22. client certificates
23. centralized authorities
25. so... storing passwords is hard
26. so... storing passwords is hard no suitable alternatives
28. decentralized
29. privacy-sensitive decentralized
30. privacy-sensitive simple decentralized
31. privacy-sensitive simple open source decentralized
32. in your browser
33. how does it work?
34. francois@mozilla.com
35. getting a proof of email ownership
36. authenticate?
37. authenticate? public key
38. authenticate? public key signed public key
39. you have a signed statement from your provider that you own your email address
47. logging into a 3rd party site
48. Valid for: 2 minutes wikipedia.org assertion
49. Valid for: 2 minutes wikipedia.org check audience assertion
50. Valid for: 2 minutes wikipedia.org check audience check expiry assertion
51. Valid for: 2 minutes wikipedia.org check audience check expiry check signature assertion
52. assertion Valid for: 2 minutes wikipedia.org public key
53. assertion Valid for: 2 minutes wikipedia.org
54. assertion session cookie
55. achieving that vision
57. email providers browser vendors
58. email providers
59. fmarier@gmail.com
60. fmarier@gmail.com
64. support for all email providers
65. browser vendors
66. navigator.id.*
67. js
68. support for all modern browsers >= 8
69. support for all modern browsers >= 8
70. using it on your site
72. <script src=”https://login.persona.org/include.js”> </script> </body></html>
73. navigator.id.watch({ loggedInEmail: “francois@mozilla.com”, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { // do something } ); }, onlogout: function () { window.location = '/logout'; } });
74. navigator.id.watch({ loggedInUser: “francois@mozilla.com”, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { // do something } ); }, onlogout: function () { window.location = '/logout'; } });
75. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { // do something } ); }, onlogout: function () { window.location = '/logout'; } });
76. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { // do something } ); }, onlogout: function () { window.location = '/logout'; } });
77. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { window.location = '/'; } ); }, onlogout: function () { window.location = '/logout'; } });
79. navigator.id.request()
83. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { window.location = '/'; } ); }, onlogout: function () { window.location = '/logout'; } });
84. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { window.location = '/home'; } ); }, onlogout: function () { window.location = '/logout'; } });
85. $ curl -d "assertion=<ASSERTION>& audience=http://123done.org" https://verifier.login.persona.org/verify
86. $ curl -d "assertion=<ASSERTION>& audience=http://123done.org" https://verifier.login.persona.org/verify
87. { status: “okay”, audience: “http://123done.org”, expires: 1344849682560, email: “francois@mozilla.com”, issuer: “login.persona.org” }
88. { status: “failed”, reason: “assertion has expired” }
92. navigator.id.logout()
93. navigator.id.watch({ loggedInUser: null, onlogin: function (assertion) { $.post('/login', {assertion: assertion}, function (data) { window.location = '/home'; } ); }, onlogout: function () { window.location = '/logout'; } });
95. 1. load javascript library
96. 1. load javascript library 2. setup login & logout callbacks
97. 1. load javascript library 2. setup login & logout callbacks 3. add login and logout buttons
98. 1. load javascript library 2. setup login & logout callbacks 3. add login and logout buttons 4. verify proof of ownership
99. play with Persona on your site tell us about your experience email one site asking for it
100. To learn more about Persona: https://login.persona.org/ http://identity.mozilla.com/ https://developer.mozilla.org/docs/Persona/Why_Persona https://developer.mozilla.org/docs/Persona/Quick_Setup https://github.com/mozilla/browserid-cookbook https://developer.mozilla.org/docs/Persona/Libraries_and_plugins http://123done.org/ https://wiki.mozilla.org/Identity#Get_Involved @fmarier http://fmarier.org
101. © 2012 François Marier <francois@mozilla.com> This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 New Zealand License. Top 500 passwords: http://xato.net/passwords/more-top-worst-passwords/ Parchment: https://secure.flickr.com/photos/27613359@N03/6750396225/ Elephant in room: https://secure.flickr.com/photos/bitboy/246805948/ Cookie on tray: https://secure.flickr.com/photos/jamisonjudd/4810986199/ Uncle Sam: https://secure.flickr.com/photos/donkeyhotey/5666065982/ Photo credits:
102. Who's using Persona?