1. OAuth:
The Next Big Thing in Security
groups.google.com/group/api-craft
Sam Ramji @sramji
Apigee sramji@apigee.com
+1-510-913-6495

2. THE PLATFORM
IMPERATIVE

3. Every market in history has had intermediaries

4. Business Intermediaries Customers

5. These intermediaries connect buyers and
sellers by knowing what both want and
creating convenient ways to transact

6. Apps are the new intermediaries.

7. Business Apps Customers

8. They occupy many niches already and
continue to multiply

9. App Store Growth 2008-2011
600 12
500 10
Apps Available
Thousands
Total App Downloads
400 8
Billions
300 6
200 4
100 2
0 0
Data from Wikipedia

10. As do devices.

11. Mary Meeker
Kleiner Perkins

12. Companies cannot build for all these niches as
each one requires distinct expertise in design
and development, and there are too many
niches.

13. As Marc Andreessen observed recently

14. “ In short, software is eating the world.
We are in the middle of a dramatic and broad
technological and economic shift in which
software companies are poised to take over
large swathes of the economy.
Marc Andreessen

15. Evans, Hagiu, and Schmalensee
explored this deeply in 2006

17. And Annabelle Gawer
has formalized the solution

19. The platform business model.

20. PLATFORMS
ARE
OPEN

21. As we’ve learned from digital natives like

23. open platforms grow the fastest.

24. Visualization by Apigee

25. In the API era of competition, speed is crucial
because critical mass leads rapidly to market
dominance.

26. [Ecosystem Competition]
Kishore S. Swaminathan, Chief Scientist, Accenture

27. Open platforms mean that
apps can be built by developers quickly
without formal commitment to
joint research,
joint development, and
joint marketing.

28. Open platforms decouple partners from the
platform provider’s business cycles.

29. This reduces the cost of innovation,
enabling many more experiments to be made
more quickly,
increasing the chance of a major improvement
to the platform business, its customers, and its
intermediaries.

30. This is low-friction innovation.

31. OPEN
DOES NOT MEAN
SECURE

32. This takes us to the stakes required for a
digital business in the API era.

33. For an intermediary to connect a buyer and
seller, there must be trust.

34. The intermediary must be trustworthy,
and the transaction must be trustworthy.

35. In modern businesses, buyers (users)
have accounts with sellers (providers)
which are filled with data
as well as transaction privileges.

36. For the system to function well,
buyers must be able to fire their intermediary
without breaking their relationship with the seller.

37. With apps as the intermediary, new dynamics
exist on top of the historical foundation.

38. Apps are new.
They are often short-lived.
Their business model depends on building a
high volume of users.
They must have some way to attain their first
transaction and be proven or else improved.

39. And this way must align with the
loose coupling philosophy at the heart
of an open platform
otherwise we’ve just secured our way back
into old-fashioned closed businesses
and killed our platform opportunity.

40. “ 20th Century IT was about raising barriers to
entry for competitors.
21st Century IT is about lowering barriers to
participation.
James Governor
Redmonk

41. So how do you build a trustworthy system
in an open world?

42. It takes an open security architecture.

43. INTRODUCING
OAUTH

45. It’s a free and open protocol
built on licenses from the
Open Web Foundation
and it’s the right choice for securing open platforms.

46. The Valet Key Metaphor

47. Eran Hammer-Lahav compares
the OAuth model to a valet key.
This is an apt metaphor.

51. A Valet Key for Open Platforms

52. The heart of OAuth
is an authorization token with limited rights
which the user can revoke at any time
should they become suspicious or dissatisfied
with the app they’re using
to access your business.

53. When the token is first granted
the business shows the user what rights the
app is asking for

55. and this negotiation is invisible to the app.

56. A perfect design for bootstrapping trust.

57. Just Enough Permission

58. An app should have just enough permission
to do the things the user wants it to.

60. OAuth allows for granular access to the user’s
account.
The current alternative is all or none
Give the app your username and password –
which gives the app access to everything
about you.

61. In OAuth, permissions can be gracefully
upgraded as well.
If the user tries to do something in an app and
they haven’t authorized the corresponding
permission, the business can give the users
the option to add that permission, using the
bootstrapping sequence used to grant the
token in the first place.

62. Just Enough Responsibility

63. App developers are not security experts.

64. A developer’s job is to make software that
does what it is supposed to do.
A security expert’s job is to make sure
software never does what it is not supposed
to do.

65. App developers DO NOT WANT the
responsibility of holding a user’s secret
information.
Usernames and passwords,
Credit card and banking information,
Lifetime history of everyone you’ve emailed
These are heavy secrets
and require heavy security.

66. The right place for these is within your own
business, secured by your own experts and
your own infrastructure investments.

67. Decoupling partners from these challenges
keeps security consistent
with the open platform potential for
low-friction innovation.

68. THE OAUTH
IMPERATIVE

69. The most popular intermediaries
are connecting buyers with several
complementary sellers at the same time

72. That increases their value to the buyer
but also multiplies the difficulty and
risk of security

73. If one app holds secrets for many businesses
that app becomes the highest-risk part of the
system.

74. As more businesses follow the platform
imperative and add APIs

75. there is an imperative for the healthy growth
of the market through the new intermediaries.

76. The imperative is to make it easy for
developers to build great apps
that can delight users
and grow businesses.

77. The imperative is for businesses
to standardize on OAuth.

78. “We have our own version of OAuth”

79. “We invented something that’s kind of like OAuth”

80. The imperative is to make it easy for
developers to build great apps
that can delight users
and grow businesses.

81. The imperative is for businesses
to standardize on OAuth.

82. No developers were harmed in the production of this
presentation.

83. THANK YOU
Questions and ideas to:
@sramji
sramji@apigee.com +1-510-913-6495
groups.google.com/group/api-craft