Identity systems on the Web are a bit of a mess. Surely in 2012, we would have something else than usernames and passwords for logging into websites. A solution that doesn't require trusting a central authority with a privacy policy that can change at a whim. It turns out that solving the general identity problem is very hard. Some of these solutions require complicated redirections, an overwhelming amount of jargon and lots of verbose XML. The technology has been around for a long time, but implementing it properly (and safely) is often incredibly difficult. It's a lot to ask of the millions of part-time developers out there that are building sites out of some quick HTML, a MySQL database and some PHP Code samples. This talk will explore the challenges of the existing Web identity solutions and introduce the choices that we made during the development of Persona, a new Open Source federated identity solution from Mozilla, designed and built to respect user privacy.

1. The Web beyond
“Usernames & Passwords”
François Marier – @fmarier

2. X
Username:
francois
Password:
****************
Sign in

3. security

10. bcrypt

11. bcrypt
per-user salt

12. bcrypt
per-user salt
site secret

13. bcrypt
per-user salt
site secret
password & lockout policies

14. bcrypt
per-user salt
site secret
password & lockout policies
secure recovery

15. bcrypt
0 1 2
2
per-user salt
o rd
site secret
s s w s
p a & lockoutne
li policies
password
id e
g u
secure recovery

17. conversion
rate

18. # hits
signup

19. # hits
signup signup_complete

20. # hits
lost
cust-
omers
signup signup_complete

21. existing solutions

22. client certificates

23. centralized authorities

25. so...
storing passwords is hard

26. so...
storing passwords is hard
no suitable alternatives

28. decentralized

29. decentralized
privacy-sensitive

30. decentralized
privacy-sensitive
simple

31. decentralized
privacy-sensitive
simple
open source

32. in your browser

33. how does it work?

34. francois@mozilla.com

35. getting a proof of email ownership

36. authenticate?

37. authenticate?
public key

38. authenticate?
public key
signed public key

39. you have a signed statement from your
provider that you own your email address

47. logging into a 3rd party site

48. assertion
wikipedia.org
Valid for: 2 minutes

49. assertion
wikipedia.org
Valid for: 2 minutes
check audience

50. assertion
wikipedia.org
Valid for: 2 minutes
check audience
check expiry

51. assertion
wikipedia.org
Valid for: 2 minutes
check audience
check expiry
check signature

52. assertion
public key
wikipedia.org
Valid for: 2 minutes

53. assertion
wikipedia.org
Valid for: 2 minutes

54. assertion
session cookie

55. achieving
that vision

57. email providers
browser vendors

58. email providers

59. fmarier@gmail.com

60. fmarier@gmail.com

64. support for all email providers

65. browser vendors

66. navigator.id.*

67. js

68. support for all
modern browsers
>= 8

69. support for all
modern browsers
>= 8

70. using it on your site

72. <script src=”https://login.persona.org/include.js”>
</script>
</body></html>

73. navigator.id.watch({
loggedInEmail: “francois@mozilla.com”,
onlogin: function (assertion) {
$.post('/login',
{assertion: assertion},
function (data) {
// do something
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

74. navigator.id.watch({
loggedInUser: “francois@mozilla.com”,
onlogin: function (assertion) {
$.post('/login',
{assertion: assertion},
function (data) {
// do something
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

75. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login',
{assertion: assertion},
function (data) {
// do something
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

76. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login',
{assertion: assertion},
function (data) {
// do something
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

77. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login',
{assertion: assertion},
function (data) {
window.location = '/';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

79. navigator.id.request()

83. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login',
{assertion: assertion},
function (data) {
window.location = '/';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

84. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login',
{assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

85. $ curl -d "assertion=<ASSERTION>&
audience=http://123done.org"
https://verifier.login.persona.org/verify

86. $ curl -d "assertion=<ASSERTION>&
audience=http://123done.org"
https://verifier.login.persona.org/verify

87. {
status: “okay”,
audience: “http://123done.org”,
expires: 1344849682560,
email: “francois@mozilla.com”,
issuer: “login.persona.org”
}

88. {
status: “failed”,
reason: “assertion has expired”
}

92. navigator.id.logout()

93. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login',
{assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

95. 1. load javascript library

96. 1. load javascript library
2. setup login & logout callbacks

97. 1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons

98. 1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons
4. verify proof of ownership

99. play with Persona
on your site
tell us about your
experience
email one site
asking for it

100. To learn more about Persona:
https://login.persona.org/
http://identity.mozilla.com/
https://developer.mozilla.org/docs/Persona/Why_Persona
https://developer.mozilla.org/docs/Persona/Quick_Setup
https://github.com/mozilla/browserid-cookbook
https://developer.mozilla.org/docs/Persona/Libraries_and_plugins
http://123done.org/
https://wiki.mozilla.org/Identity#Get_Involved
@fmarier http://fmarier.org

101. Photo credits:
Top 500 passwords: http://xato.net/passwords/more-top-worst-passwords/
Parchment: https://secure.flickr.com/photos/27613359@N03/6750396225/
Elephant in room: https://secure.flickr.com/photos/bitboy/246805948/
Cookie on tray: https://secure.flickr.com/photos/jamisonjudd/4810986199/
Uncle Sam: https://secure.flickr.com/photos/donkeyhotey/5666065982/
© 2012 François Marier <francois@mozilla.com>
This work is licensed under a
Creative Commons Attribution-ShareAlike 3.0 New Zealand License.

102. Who's using Persona?