Killing Passwords with JavaScript
-
Upload
francois-marier -
Category
Technology
-
view
418 -
download
0
Transcript of Killing Passwords with JavaScript
problem #1:
passwords are hard to secure
bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery
bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery
bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery
bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery
bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery
bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery
20132013
passwordpassword
guidelines
guidelines
passwords are hard to secure
they are a liability
ALTER TABLE userDROP COLUMN password;
problem #2:
passwords are hard to remember
pick an easy password
pick an easy password
use it everywhere
passwords are hard to remember
they need to be reset
controlemail
account
controlall
accounts=
“People wanta little dating
before marriage.”Eric Vishria – Rockmelt
decentralised
myid.com/u/francois
privacy®
existing login systemsare not good enough
ideal web-wide identity system
● decentralised● simple● cross-browser
ideal web-wide identity system
● decentralised● simple● cross-browser
ideal web-wide identity system
● decentralised● simple
cross-browser
ideal web-wide identity system
what if it were a standardpart of the web browser?
how does it work?
demo #1:
http://www.voo.st/http://www.debuggex.com
Persona is already adecentralised system
SMS with PIN codes
SMS with PIN codes
Jabber / XMPP
SMS with PIN codes
Jabber / XMPP
Yubikeys
SMS with PIN codes
Jabber / XMPP
Yubikeys
LDAP accounts
SMS with PIN codes
Jabber / XMPP
Yubikeys
LDAP accounts
Client certificates
SMS with PIN codes
Jabber / XMPP
Yubikeys
LDAP accounts
Client certificates
Password-wrapped secret key
{ "public-key": { "algorithm": "RS", "n":"685484565272...", "e":"65537" }, "encrypted-private-key": { "iv": "tmg7gztUQT...", "salt": "JMtGwlF5UWY", "ct": "8DdOjD1IA1..." }, "authentication": "...", "provisioning": "..."}
decentralisation is the answer, but it's not
a product adoption strategy
we can't wait for all browsersto adopt Persona
navigator.id.*
we can't wait for all browsersto adopt Persona
solution: a temporaryjavascript shim
LIFD
LocallyIsolatedFeatureDomain
goal: trusted coderunning in the browser
login.persona.org
localStorage
localStorage.setItem("key", serializedKey);
var serializedKey = localStorage.getItem("key");
storage tied tologin.persona.org
window.postMessage()
https://login.persona.org
localStorage
postMessage
Persona supportsall modern browsers
>= 8
we can't wait for all domainsto adopt Persona
we can't wait for all domainsto adopt Persona
solution: a temporarycentralised fallback
Persona already workswith all email domains
identity bridging
Persona works everywhere
lessons learned
#1 user testingis critical
#2 nobody wantsto be first
“how many usersdoes Persona have?”
700,000,000
#3 if a problem hasbeen around for awhile, it's probablya hard one
see if you can solvepart of the problem
$ ssh [email protected]@myserver.com's password:
Persona is a simplesolution for
signing into the web
how simple is it
for developers?
how simple is it
for developers?
4 easy stepshttps://developer.mozilla.org/docs/Persona/Quick_Setup
1. load javascript library
<script src=”https://login.persona.org/include.js”>
1. load javascript library
2. setup login & logout callbacks
navigator.id.watch(...);
1. load javascript library
2. setup login & logout callbacks
navigator.id.watch(...);
1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons
navigator.id.request();navigator.id.logout();
1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons
4. verify proof of ownership
1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons
4. verify proof of ownership
no API keyneeded
one small request
building a new site:default to Persona
working on an existing site:add support for Persona
before
after
after
navigator.id.request()
ALTER TABLE userDROP COLUMN password;
To learn more about Persona:
https://login.persona.org/http://identity.mozilla.com/
https://developer.mozilla.org/docs/Persona/Why_Personahttps://developer.mozilla.org/docs/Persona/Quick_Setup
https://github.com/mozilla/browserid-cookbookhttps://developer.mozilla.org/docs/Persona/Libraries_and_plugins
https://wiki.mozilla.org/Identity#Get_Involved
@fmarier http://fmarier.org
identity provider API
https://eyedee.me/.well-known/browserid:
{ "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html"}
https://eyedee.me/.well-known/browserid:
{ "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html"}
identity provider API
https://eyedee.me/.well-known/browserid:
{ "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html"}
identity provider API
https://eyedee.me/.well-known/browserid:
{ "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html"}
identity provider API
https://eyedee.me/.well-known/browserid:
{ "public-key": { "algorithm":"RS", "n":"8606...", "e":"65537" }, "authentication": "/browserid/sign_in.html", "provisioning": "/browserid/provision.html"}
identity provider API
identity provider API
1. check for your /.well-known/browserid
2. try the provisioning endpoint
3. show the authentication page
4. call the provisioning endpoint again
identity provider API
1. check for your /.well-known/browserid
2. try the provisioning endpoint
3. show the authentication page
4. call the provisioning endpoint again
identity provider API
1. check for your /.well-known/browserid
2. try the provisioning endpoint
3. show the authentication page
4. call the provisioning endpoint again
identity provider API
1. check for your /.well-known/browserid
2. try the provisioning endpoint
3. show the authentication page
4. call the provisioning endpoint again
© 2013 François Marier <[email protected]>This work is licensed under aCreative Commons Attribution-ShareAlike 3.0 New Zealand License.
Laptop password: https://secure.flickr.com/photos/reidrac/4696900602/
Top 500 passwords: http://xato.net/passwords/more-top-worst-passwords/
Restaurant dinner: https://secure.flickr.com/photos/yourdon/3977084094/
Parchment: https://secure.flickr.com/photos/27613359@N03/6750396225/
Yubikey: https://secure.flickr.com/photos/knk/3379897261/
Stop sign: https://secure.flickr.com/photos/artbystevejohnson/6673406227/
Photo credits: