#MBLTdev: Современная аутентификация (PayPal)

Modern Day Authentication
Tim Messerschmidt
Head of Developer Advocacy, EMEA
PayPal + Braintree
Braintree_Dev. @SeraAndroid / @PayPalDev

That’s me

>Death to Passwords _

The top 1000 most used
passwords of 2012
wiki.skullsecurity.org/Passwords

4.7% OF ALL USERS USE THE
PASSWORD PASSWORD

8.5% OF ARE USING
PASSWORD OR 123456

9.8% USE PASSWORD,
123456 OR 12345678

... and it doesn’t even stop here
14% have a password from the top 10

A brief analysis of the
situation in 2013
cbsn.ws/1siTPGH

1. 123456
2. password
3. 12345678
4. qwerty
5. abc123
6. 123456789
7. 111111
8. 1234567
9. iloveyou
10. Adobe123
11. 123123
12. admin
13. 1234567890
14. letmein
15. photoshop
16. 1234
17. monkey down
18. shadow
19. sunshine
20. 12345

1. 123456 up 1
2. password down 1
3. 12345678
4. qwerty up 1
5. abc123 down 1
6. 123456789 new
7. 111111 up 2
8. 1234567 up 5
9. iloveyou up 2
10. adobe123 new
11. 123123 up 5
12. admin new
13. 1234567890 new
14. letmein down 7
15. photoshop new
16. 1234 new
17. monkey down 11
18. shadow
19. sunshine down 5
20. 12345 new

>The 3 key problems _

Braintree_Dev. abstrusegoose.com/2@9S6e raAndroid / @PayPalDev

“Favor experience /$security too much over the
and you’ll d+/ make the
website a pain to use.”
smashingmagazine.com/2012/10/26/password-masking-hurt-signup-form

vs.

People forget passwords…
45% admit to leaving a website instead of re-setting
their password or answering security
questions
- Blue Inc. 2011

Let’s admit it:
Passwords really suck!

People hate to register
Out of 657 surveyed users 66% think that
social sign-in is a desirable alternative.
- Blue Inc. 2011

> Braintree Says Goodbye to Passwords
With One Touch Payments for PayPal and
Venmo, and Hello to Bitcoin braintreepayments.com/blog/goodbye-passwords-one-touch-hello-bitcoin

Merchant app
PayPal app
Merchant app

2 Factor Authentication
twofactorauth.org

Passwordless Authentication
medium.com/@ninjudd/passwords-are-obsolete-9ed56d483eb

Authorization Authentication Braintree_Dev. @SeraAndroid / @PayPalDev

/OAu$th d1.+0 /
2007

The
Consumer
Request
Request Token
Service
Provider
Grant
Request Token
Direct User
to Service
Obtain
Authorization
Direct to
Consumer
Request
Access Token
Grant
Access Token
Access
Resources

/OAu$th 1d.0+a/
2009

/OAu$th d2.+0 /
2012

The
Consumer
Direct User
to Service
Service
Provider
Obtain
Authorization
Request
Access Token
Grant
Access Token
Direct to
Consumer
Access
Resources

/O$penIdD +/

/Comb$inatdio+n/s

What’s next? Braintree_Dev. @SeraAndroid / @PayPalDev

Utilizing A Trusted Environment Braintree_Dev. @SeraAndroid / @PayPalDev

Scaling Security Braintree_Dev. @SeraAndroid / @PayPalDev

FIDO Alliance Braintree_Dev. @SeraAndroid / @PayPalDev

1 Security
Matters to users and developers
2 Difference
Authentication and Authorization
3 User Experience
Should be enhanced not impaired

Спасибо за внимание!
tim@getbraintree.com
braintreepayments.com/developers
slideshare.com/PayPal

#MBLTdev: Современная аутентификация (PayPal)

Recomendados

Recomendados

Más contenido relacionado

Similar a #MBLTdev: Современная аутентификация (PayPal)

Similar a #MBLTdev: Современная аутентификация (PayPal) (20)

Más de e-Legion

Más de e-Legion (20)

Último

Último (7)

#MBLTdev: Современная аутентификация (PayPal)