TrustAuth 1.0!

These slides introduce the problem and how TrustAuth solves it.

Transcript

1. <You go here> TrustAuth A secure way to login. Daniel Fox, @romaimperator Tuesday, June 19, 12
2. TrustAuth 04 Why should I use TrustAuth? 03 How does TrustAuth work? 01 What’s the problem? Table of Contents 02 What are the current solutions? Tuesday, June 19, 12
3. TrustAuth What’s the problem? Hacking. Tuesday, June 19, 12
4. TrustAuth ‣ Most sites today use username and passwords ‣ Secret information under someone else’s control • Is it properly stored? Passwords Tuesday, June 19, 12
5. TrustAuth Hacking ‣ Websites are compromised all the time ‣ YouPorn • up to 1 million email addresses and passwords posted online ‣ LinkedIn • 6.5 million passwords ‣ eHarmony • 1.5 million passwords ‣ Last.fm • 2.5 million passwords Tuesday, June 19, 12
6. TrustAuth Hacking ‣ Emails and passwords are often reused • Easier to remember • If one site is compromised, all are compromised ‣ Many sites constrain passwords • Low limits on length (My bank’s limit is 8 chars) • Disallowing special characters Tuesday, June 19, 12
7. 02 What are the current solutions? 01 What’s the problem? TrustAuth 04 Why should I use TrustAuth? 03 How does TrustAuth work? Table of Contents Tuesday, June 19, 12
8. TrustAuth Current Solutions Tuesday, June 19, 12
9. TrustAuth OAuth ‣ Doesn’t OAuth solve these problems? • Sort of ‣ OAuth uses session keys instead of a username and password • Must still use username and password to login to Facebook, Twitter, or Google Tuesday, June 19, 12
10. TrustAuth OAuth Problems ‣ If you use Facebook Connect, you must still trust Facebook ‣ Most OAuth providers lists websites you have authenticated • An attacker can use this to gain access to those sites ‣ Compromised Facebook account means all of those sites are compromised Tuesday, June 19, 12
11. TrustAuth OAuth Problems ‣ Redirection to another website to login • Users are getting accustomed to redirection ‣ Easier for attackers to steal credentials ‣ Redirect user to faceb00k.com • Can have a valid SSL certificate • Only subtle differences to real page Tuesday, June 19, 12
12. TrustAuth OAuth Identity ‣ When you login to a site with Twitter the site is given your Twitter username ‣ Other sites will be get your Twitter username ‣ Your username can be used to identify you ‣ An attacker can assume the person on site 1 is also using site 2 • This lets them track you between websites Tuesday, June 19, 12
13. TrustAuth BrowserID ‣ BrowserID allows you to prove ownership of an email address ‣ It requires that you trust a third-party to vouch for you • Basically saying, “Yes, this person owns that email” ‣ Like OAuth with Twitter, the email address uniquely identifies you Tuesday, June 19, 12
14. 03 How does TrustAuth work? 02 What are the current solutions? 01 What’s the problem? TrustAuth 04 Why should I use TrustAuth? Table of Contents Tuesday, June 19, 12
15. TrustAuth TrustAuth A better solution Tuesday, June 19, 12
16. TrustAuth How it works ‣ TrustAuth solves the previous problems elegantly using public key cryptography ‣ With TrustAuth, two keys are created: • Private Key - similar to a password, must be secret • Public Key - can be shared with anyone ‣ These two keys are mathematically linked Tuesday, June 19, 12
17. TrustAuth How it works: Registration ‣ Sign up for a website that supports TrustAuth • The browser plugin provides the site with your public key when you register ‣ Login to an existing account • The plugin will also automatically provide your public key to the website Tuesday, June 19, 12
18. TrustAuth How it works: Login ‣ Sites that support TrustAuth send your browser a special value with the login form ‣ The browser plugin takes this value and signs it using your private key ‣ When you hit the login button, the signed data is sent to the server • After verification you are logged in Tuesday, June 19, 12
19. 04 Why should I use TrustAuth? 03 How does TrustAuth work? 02 What are the current solutions? 01 What’s the problem? TrustAuth Table of Contents Tuesday, June 19, 12
20. TrustAuth Why should I use TrustAuth? Tuesday, June 19, 12
21. TrustAuth Reasons to use TrustAuth: ‣ You don’t have to manage or remember passwords ‣ Never worry about how a website stores passwords because your secret key isn’t revealed ‣ Unlike OAuth or BrowserID, TrustAuth is TNO (trust no one) Tuesday, June 19, 12
22. TrustAuth More reasons for TrustAuth: ‣ Security breaches are contained. • A stolen account on one website cannot compromise accounts on other websites. ‣ As a user, using TrustAuth is easy • Just install the add-on and start logging in! ‣ As a web developer, adding TrustAuth is easy • Install a plugin for your framework or use the library Tuesday, June 19, 12
23. <You go here> TrustAuth A secure way to login. Daniel Fox, @romaimperator Tuesday, June 19, 12