1. Bastian Hofmann
ResearchGate GmbH
The Identity Problem of the Web
and how to solve it

7. Questions? Ask!

8. http://slideshare.net/bashofmann

9. Only one identity?

10. Identity is conveyed by communication
Identity is not fixed but recreated by every
communication with your fellows
Expectations of different people result in
different identities
Lothar Krappmann

11. Paul Adams
http://www.slideshare.net/padday/the-real-life-social-network-v2

14. Sign up again and again

15. Passwords are broken
Same password for more than one service
Saved unsecurely in the browser
Names, birthdays, car brand, ...
Disclosed to others
Too short, too simple
Sent over non encrypted connections

16. Single Sign On

17. Microsoft Live ID
Launched 1999 as .net Passport

18. Facebook Connect

20. And there are much more

21. Nascar problem

22. Aggregation
http://www.janrain.com/

23. OpenID
http://openid.net/

24. The Client

25. http://bhofmann.myopenid.com

27. http://bhofmann.myopenid.com

28. HTTP POST
http://bhofmann.myopenid.com
stackoverflow.com

29. bhofmann.myopenid.
com
HTTP POST
http://bhofmann.myopenid.com
stackoverflow.com
HTTP GET

30. bhofmann.myopenid.
com
HTTP POST
http://bhofmann.myopenid.com
stackoverflow.com
<link
rel="openid2.provider"
href="http://
www.myopenid.com/server" />

31. myopenid.com/
server
HTTP POST
http://bhofmann.myopenid.com
stackoverflow.com
Establish shared secret
(Diffie-Hellman)

32. HTTP Redirect
http://myopenid.com/server?
openid.identity=http://
bhofmann.myopenid.com&...
stackoverflow.com

33. HTTP GET
myopenid.com/
server?
openid.identity=
http://
bhofmann.myope
nid.com&...

34. Login
myopenid.com/
server?
openid.identity=
http://
bhofmann.myope
nid.com&...

35. Grant permission
myopenid.com/
server?
openid.identity=
http://
bhofmann.myope
nid.com&...

36. HTTP Redirect
http://stackoverflow.com/?assertion...
myopenid.com/
server?
openid.identity=
http://
bhofmann.myope
nid.com&...

37. HTTP GET
stackoverflow.com
Verify assertion

38. DEMO
http://stackoverflow.com/
https://www.myopenid.com/

39. Authentication vs Authorization
Who is the user?
Is this really user X?
VS
Is X allowed to do something?
Does X have the permission?
Client sites want more than just a
unique identifier (Social Graph)

40. But there are Spec Extensions

41. Additional parameters on the redirects

42. Simple Registration

43. openid.sreg.required=openid.sreg.fullname&
openid.sreg.optional=openid.sreg.email,openid.sreg.gender
openid.sreg.fullname=Bastian&openid.sreg.gender=male

44. Attribute Exchange

45. penid.ns.ax=http://openid.net/srv/ax/1.0
openid.ax.mode=fetch_request
openid.ax.type.fname=http://example.com/schema/fullname
openid.ax.type.gender=http://example.com/schema/gender
openid.ax.type.fav_dog=http://example.com/schema/favourite_dog
openid.ax.type.fav_movie=http://example.com/schema/
favourite_movie
openid.ax.count.fav_movie=3
openid.ax.required=fname,gender
openid.ax.if_available=fav_dog,fav_movie
openid.ax.update_url=http://idconsumer.com/update?
transaction_id=a6b5c41

46. openid.ns.ax=http://openid.net/srv/ax/1.0
openid.ax.mode=fetch_response
openid.ax.type.fname=http://example.com/schema/fullname
openid.ax.type.gender=http://example.com/schema/gender
openid.ax.type.fav_dog=http://example.com/schema/favourite_dog
openid.ax.type.fav_movie=http://example.com/schema/
favourite_movie
openid.ax.value.fname=John Smith
openid.ax.count.gender=0
openid.ax.value.fav_dog=Spot
openid.ax.count.fav_movie=2
openid.ax.value.fav_movie.1=Movie1
openid.ax.value.fav_movie.2=Movie2
openid.ax.update_url=http://idconsumer.com/update?
transaction_id=a6b5c41

47. openid.ns.ax=http://openid.net/srv/ax/1.0
openid.ax.mode=store_request
openid.ax.type.fname=http://example.com/schema/fullname
openid.ax.value.fname=Bob Smith
openid.ax.type.fav_movie=http://example.com/schema/
favourite_movie
openid.ax.count.fav_movie=2
openid.ax.value.fav_movie.1=Movie1
openid.ax.value.fav_movie.2=Movie2

48. openid.ns.ax=http://openid.net/srv/ax/1.0
openid.ax.mode=store_response_success

49. http://oauth.net/

50. Pre Registration of Client at
Twitter:
twitter.com
- Shared Consumer Key
- Shared Consumer Secret
lanyrd.com

51. HTTP POST
Connect with Twitter
lanyrd.com

52. twitter.com
HTTP POST
Connect with Twitter
HTTP GET
lanyrd.com Consumer Key
Redirect URI
Signature (Consumer
Secret)

53. twitter.com
HTTP POST
Connect with Twitter
lanyrd.com
Request Token
Request Token Secret

54. HTTP Redirect
http://twitter.com/authorize?
requestToken=...&consumerKey=...
lanyrd.com

55. HTTP GET
twitter.com/
authorize

56. Login
twitter.com/
authorize

57. Grant permission
twitter.com/
authorize
Create verifier
and bind it to
User and Request
Token

58. HTTP Redirect
Redirect URI?verifier=...&requestToken=..
twitter.com/
authorize

59. HTTP GET
lanyrd.com
(RedirectURI?
verifier=...)

60. twitter.com
HTTP GET
HTTP GET
lanyrd.com Consumer Key,
RequestToken
Verifier
Signature (Consumer &
Request Token Secret)

61. twitter.com
HTTP GET
lanyrd.com
Access Token
Access Token Secret

62. twitter.com
HTTP GET
lanyrd.com
API Request
Consumer Key, Access Token
Signature (Consumer &
Access Token Secret)

63. OpenID + OAuth
• Combines OpenID Authentication and
OAuth authorization
openid.ns.oauth=http://specs.openid.net/extensions/oauth/1.0
&openid.oauth.consumer=123456
openid.ns.oauth=http://specs.openid.net/extensions/oauth/1.0
&openid.oauth.request_token=7890

64. OpenID is dead

65. „OpenID has been a burden on support
since the day it was launched.“
„Fewer than 1% of all 37signals users are
currently using OpenID.“
http://productblog.37signals.com/products/2011/01/well-be-retiring-our-
support-of-openid-on-may-1.html

66. „OpenID is the worst possible "solution"
I have ever seen in my entire life to a
problem that most people don't really
have.“
Yishan Wong (Facebook)
http://www.quora.com/What-s-wrong-with-OpenID

67. Failures of OpenID 2.0
Complex to implement
No marketing
Do you have an OpenID?
What is it?
URL as identifier => Bad User Experience

68. Facebook Connect
250,000,000 monthly users

69. So let‘s all use Facebook?

70. How to fix it?

71. Easier to implement
Better user experience
Built on top of OAuth 2.0
More simple specification
wider adption

72. What‘s wrong with OAuth?
Does not work well with non web or
JavaScript based clients
The „Invalid Signature“ Problem
Complicated Flow, many requests

73. http://oauth.net/

74. What‘s new in OAuth2? (Draft 10)
No signatures
Cookie-like Bearer Token
Different client profiles
No Token Secrets
No Request Tokens
Mandatory TSL/SSL
Much more flexible regarding extensions
http://tools.ietf.org/html/draft-ietf-oauth-v2

75. Web-Server Profile

76. Pre Registration of Client at
Twitter:
twitter.com
- Shared Client ID
- Shared Client Secret
- Redirect URI
lanyrd.com

77. HTTP(S) POST
Connect with Twitter
lanyrd.com

78. HTTPS Redirect
http://twitter.com/authorize?&clientId=...
lanyrd.com

79. HTTPS GET
twitter.com/
authorize

80. Login
twitter.com/
authorize

81. Grant permission
twitter.com/
authorize
Create
authorization code
and bind it to
User and ClientID

82. HTTPS Redirect
Redirect URI?authorizationCode=...
twitter.com/
authorize

83. HTTPS GET
lanyrd.com
(RedirectURI?
authorizationCode=
...)

84. twitter.com
HTTPS GET
lanyrd.com HTTPS GET
Consumer Key
Authorization Code
Consumer Secret

85. twitter.com
HTTPS GET
lanyrd.com
Access Token
(Refresh Token)

86. twitter.com
HTTPS GET
lanyrd.com
HTTPS API Request
Access Token

87. twitter.com
HTTPS GET
lanyrd.com HTTPS GET
Consumer Key
Refresh Token
Consumer Secret

88. twitter.com
HTTPS GET
lanyrd.com
Access Token
Refresh Token

89. User-Agent Profile

90. lanyrd.com
Open Popup
http://twitter.com/authorize?&clientId=...

91. lanyrd.com
Open Popup
http://twitter.com/authorize?&clientId=...
twitter.co
m/
authorize
HTTPS GET

92. lanyrd.com
Open Popup
http://twitter.com/authorize?&clientId=...
twitter.co
m/
authorize
Login

93. lanyrd.com
Open Popup
http://twitter.com/authorize?&clientId=...
twitter.co
m/
authorize
Grant
Permission

94. lanyrd.com
twitter.co
m/ lanyrd.com
authorize
HTTPS Redirect RedirectURI#
RedirectURI#acces accessToken
sToken

95. lanyrd.com
Parse Access Token from Fragment
Send it to opening window
Close popup lanyrd.com
RedirectURI#
accessToken

96. Same Origin Policy

97. lanyrd.com
HTTPS Ajax twitter.com
Request to API
Access Token

98. Same Origin Policy

99. JSONP

100. Cross Origin Request
Sharing (CORS)

101. Client Backend
lanyrd. api.twitter.com
com
AJAX
Access-Control-Allow-Origin: *
http://www.w3.org/TR/cors/

102. What happend to signatures?
Bearer Tokens are fine over secure connection
Vulnerable if discovery is introduced
Or if TSL/SSL is not possible
So OAuth 1.0 signatures alternatively available

103. Scopes
Optional parameter for provider
specific implementations
Additional return values
Access Control

104. Scope: „openid“
With access token additional values are returned
UserID: URL to Portable Contacts endpoint
Timestamp
Signature
http://openidconnect.com/

105. https://github.com/vznet/vz_id_democlient
http://opensocial-demo.vz-modules.net/vzid/index.php

106. DEMO

107. OpenID Connect
Discovery
Get Identifier of user
Call /.well-­‐known/host-­‐meta file at
the domain of the user‘s provider
Look for a link pointing to the OpenID
Connect endpoints in the returned
LRDD

108. http://example.com/.well-
known/host-meta
http://tools.ietf.org/html/draft-nottingham-site-meta

109. http://code.google.com/p/webfinger/

110. http://www.oexchange.org/

111. Phishing

112. @ E-mail address
equals identity?

113. Can the browser help?

114. FOAF+SSL (WebID)
http://esw.w3.org/Foaf%2Bssl

115. DEMO
http://trunk.ontowiki.net/
http://www.w3.org/wiki/Foaf%2Bssl/IDP

116. Bad browser UI
Syncing between different computers?
More than one user on the same computer?

117. Mozilla UX Mockups

118. https://browserid.org/

119. DEMO
http://myfavoritebeer.org/
https://addons.mozilla.org/en-US/firefox/addon/browser-
sign-in/

120. Summing it up
• We need a single sign on system for the
web
• Proprietary solutions are bad for users, site
owners and developers
• OpenID is cool, but has some problems
• A new more simple and flexible spec is
coming up
• Browser vendors are working to solve this
problem in the browser

121. Rate and Comment
http://spkr8.com/t/8738

122. h"p://twi"er.com/Bas2anHofmann
h"ps://profiles.google.com/bashofmann
h"p://lanyrd.com/people/Bas2anHofmann/
h"p://slideshare.net/bashofmann
mail@bas2anhofmann.de