Authenticate a user without a username, password, or database

How do you authenticate your users? Authentication is such a common feature we don’t even think about it anymore. Let’s challenge the status quo and authenticate a user with, well, nothing. Not even a database, and no API in its place. Do we need databases at all? Let’s talk.

Developed an application exploring the possibility of signing in without a username, password or a database on the web using Elixir/Erlang. I shared this as the closing keynote at Rubyfuza 2019.

Google slides: https://docs.google.com/presentation/d/1XJiBXD6uzWaFYbTXqacBmQZZEuicYN_CcSc2JDmcpUA/edit?usp=sharing

Transcript

1. How to authenticate a user without a username, password or database
3. this app does nothing .com “This app literally does nothing.” TechCrunch
4. Ricardo García Vega @bigardone Joe Armstrong @joeerl Sarah Drasner @sarah_edo
5. Some backstory
6. I really hate computers
7. This is serious business a little fun
8. Open your mind
9. i. Identity claim ii. Identity verification iii. Identity storage How does authentication work?
10. Claim Verify Store How would you do identity claim? a. Don’t be silly, just use OAuth b. Gait analysis c. Use their face d. Security is a lie
11. Claim Verify Store How would you do identity claim? a. Don’t be silly, just use OAuth b. Gait analysis c. Use their face d. Security is a lie
12. Claim Verify Store How would you do identity verification? a. Obviously a blood test b. OAuth, you will be assimilated c. Send them an OTP d. Fingerprint or retinal scan
13. Claim Verify Store How would you do identity verification? a. Obviously a blood test b. OAuth, you will be assimilated c. Send them an OTP d. Fingerprint or retinal scan
14. Claim Verify Store How would you do identity storage? a. Throw it in a file - that’s not a database is it? b. Mechanical turk: an army of humans write it out on paper c. Machine learning serverless blockchain™ d. Keep it in memory and never let the server die
15. Claim Verify Store How would you do identity storage? a. Throw it in a file - that’s not a database is it? b. Mechanical turk: an army of humans write it out on paper c. Machine learning serverless blockchain™ d. Keep it in memory and never let the server die
16. How does nada work?
17. Claim Verify Store Facial recognition One time pin Memory storage Slack’s “magic links” or an OTP sent to an email address Erlang process storing face to email mapping in memory Face to email mapping used to identify a user
18. Nada Faces API Nada App AWS Rekognition Sign up AWS S3 { selfie } { face_id } { email selfie } Claim { email face_id } Store { otp } Verify
19. Nada Faces API Nada App AWS Rekognition Log in AWS S3 { selfie } { face_id } { email face_id } Store { otp } Verify { selfie } Claim
20. Claim Verify Store Face to email mapping used to identify a user Facial recognition # @ Face Face ID Email Image
21. Claim Verify Store One time pin Slack’s “magic links” or an OTP sent to an email address user@example.com Log in
22. Claim Verify Store One time pin Slack’s “magic links” or an OTP sent to an email address user@example.com mail@nada.com thisappdoesnothing.com/djtufy TO FROM
23. Claim Verify Store One time pin Slack’s “magic links” or an OTP sent to an email address SUCCESS!
24. Claim Verify Store Memory storage Erlang process storing face to email mapping in memory Erlang VM Web server process Agent process ...
25. Claim Verify Store Memory storage Erlang process storing face to email mapping in memory Erlang VM Web server process “a7j3hgdg”: “bob@gold.com” “jmd739sh”: “sam@mail.com”
26. Demo
27. Data storage with Erlang/Elixir
28. Java Fault-tolerance Erlang “Write once, run anywhere.” “Write once, run forever.”
29. Clojure Java VM Elixir Erlang VM “BEAM”
30. 2019 Today 2011 ~8 years ago 1986 33 years ago
31. Object-oriented Functional Process-oriented
32. “[Erlang] is the language of the system.” Rich Hickey
33. Erlang data stores • Mnesia • ETS (Erlang Term Storage) • Process state (GenServer/Agent) • *Riak
34. • Are there relationships between the data you store? • Are you storing time-related data? • Do you need to be able to look at the database in the past? How do you intend to query the data?
35. • Relational • Object / Document • Graph • Key-Value • Time series • Fact tables Typical data storage options by query
36. What have we learned?
37. Have fun
38. You can do “AI”
39. A new programming model
40. Choose a database
41. Don’t cargo-cult software design
42. Make a responsible decision
43. that’s it
46. https://github.com/thoughtbot?utf8=%E2%9C%93&q=&type=public&language=elixir
47. thank you Simon van Dyk @siefi