Slideshow Transcript

1. Slide 1: Emerging From Web 2.0 Web 2.0 Expo Berlin 2007
2. Slide 2: \"Its definitely time to declare \"OpenID is a protocol made OpenID a winner\" for the public, by the public. TechCrunch No one owns or controls your login information:You do.\" 37signals \"...sees great potential for OpenID's use alongside enterprise-ready software infrastructure\" Sun Microsystems \"taking the world by storm\" \"this high profile announcement marks Tim O'Reilly the importance of single sign on identity technology to the future of the Internet\" ReadWriteWeb
3. Slide 3: What is OpenID? • Single sign-on for the web • Simple and light-weight (not going to replace your bank card pin) • Easy to use and deploy • Built upon proven existing technologies (DNS, HTTP, SSL/TLS, Diffie-Hellman) • Decentralized (you don't have to ask anyone permission to implement it) • Free!
4. Slide 4: An OpenID is a URI • URLs are globally unique and ubiquitous • OpenID allows proving ownership of an URI • People already have identity at URLs via blogs, photos, MySpace, FaceBook, etc • People already describe relationships via URLs (e.g. links to my friends)
5. Slide 5: OpenID is Decentralized
6. Slide 6: Benefits • Reduces the number of usernames and passwords • Simplifies new account creation • Allows for lightweight accounts • Simplifies internal SSO • Enables wide-spread benefit of strong authentication • Enables decentralized reputation • Enables social network portability
7. Slide 7: O M E How Does it Work? D
8. Slide 8: As a Conversation Who are you? I’m davidrecordon.com Prove it!
9. Slide 9: Discovers My Provider \"openid.server\" points to my OpenID Provider
10. Slide 10: (crypto happens)
11. Slide 11: Getting an OpenID http://openid.net/get/
12. Slide 12: OpenID is Really Easy
13. Slide 13: \"This is a geek's toy, nobody will ever have an OpenID!\"
14. Slide 14: ~160 million OpenIDs (including every AOL user) OpenID 1.1 - Estimated from various services
15. Slide 16: \"Nobody will ever use this!\"
16. Slide 17: Total Relying Parties (aka places you can login with OpenID) 6,000 4,500 3,000 1,500 0 ov b ay ly '06 ar ne ov ay ly '05 ct ec r g ne p ec '07 b ct ar r st 22 Ap Ap Au Fe Se Fe Ju Ju gu O O M M M M D D Ju Ju N N p p Jan Jan Au Se Se OpenID 1.1 - As viewed by MyOpenID.com
17. Slide 18: \"So that's great there are so many blogs, but what about something real?\"
18. Slide 20: \"What about security?\"
19. Slide 21: “Protocol Security?”
20. Slide 22: like any protocol...think as you implement
21. Slide 23: the best solutions may around the browser
22. Slide 24: MyVidoop Plugin (a password manager tied into your OpenID account add-on for Firefox)
23. Slide 25: Sxipper (a form filler password manager with OpenID integration add-on for Firefox)
24. Slide 26: Symantec Identity Client (OpenID form-fill, upcoming provider, and claims integration)
25. Slide 27: VeriSign's OpenID SeatBelt (an OpenID convenience and security add-on for Firefox) works with
26. Slide 28: IE Team has posted a job ad mentioning \"OpenID\" \"Does the idea of redefining the role of the Internet browser appeal to you? Do the terms HTTP, RSS, Microformats, and OpenID, excite you? If so, then this just might be the opportunity for you.\"
27. Slide 29: OpenID is great for innovation
28. Slide 30: “So, what about OpenID 2.0?”
29. Slide 31: OpenID 2.0 • Cleans up the 1.1 specification • Adds a few useful features • Robust extensibility • Enhanced service discovery • \"Directed identity\" • XRI • About six independent library implementations of final draft
30. Slide 32: “Any OpenID in the enterprise?”
31. Slide 33: Offer all employees OpenIDs; open source Enterprise SSO and identity manager with LDAP and OpenID Internal SSO for bug trackers and wikis OpenID Provider with plans to ship in enterprise products this year Shared OpenID Provider for their businesses and partners Project management, CRM, and billing for small businesses
32. Slide 34: Open.ID.ee
33. Slide 35: I come from E-stonia • A small EU country with ~1.3M inhabitants • Access to internet considered a “civil right” • Had first parliament elections over the internet in 2005 • 80%+ of the population have a digital ID- card
34. Slide 36: ID-card
35. Slide 37: ID-card is a... • Photo ID like any other • We are interested in Electronic ID: • The chip contains your name, age, gender and social security number • Two PIN codes: one for authentication and one for signing documents
36. Slide 38: Authentication • Is about proving who you are. • Available to any service that wants to use it • Online banking • Filing your taxes • Various other services
37. Slide 43: \"How does this happen?\"
38. Slide 44: Entering your PIN code is your consent to send personal data to the service
39. Slide 45: Yes/No decision
40. Slide 46: \"So what is the problem?\"
41. Slide 47: Users do not always want this. Users want control of their personal data.
42. Slide 48: What is Identity? • Wikipedia: “the sameness of two things” • “Things” are users • Users are website visitors • “Who are you?”
43. Slide 49: Are you the same you that signed up with us?
44. Slide 50: ID-card contains government verified identity
45. Slide 51: Same Can be Different • Bank: Martin Paljak, the account owner • Forum: user who registered as “catluvr99” • Blog: author of the comment • http://open.id.ee/martin.paljak is Martin Paljak
46. Slide 52: Is the OpenID you present the same as we have in our database?
47. Slide 53: Websites really need to match identifiers, not collect your personal data.
48. Slide 54: Solution: OpenID • id.ee => open.id.ee • OpenID service that uses ID-cards for authentication • Gives users more control over their private data • Is NOT a government enforced/controlled service
49. Slide 55: Simplicity • One privacy policy to check • One trust decision to make • One purpose for the OpenID service • Encapsulate and protect users’ private data
50. Slide 56: No need to sign up, it JustWorks
51. Slide 57: ... if you have the needed hardware and software ...
52. Slide 61: \"So if everybody implements OpenID, are we all happy?\"
53. Slide 62: \"What about website developers?\"
54. Slide 63: ID-card Sucks! • Implementing support is difficult • Technically challenging (SSL certificates and such) • Users don’t like ID-cards anyway as they are often afraid of privacy issues • Most sites don’t need so high security • So... why bother?
55. Slide 64: I Forgot! • Mobile-ID: same stuff inside your GSM SIM card • Same technology inside ... • ... but totally different to implement ... • ... AGAIN!!!
56. Slide 65: What is Mobile-ID? • Smaller ID-card • No hardware needed - your phone is your card reader • No need to install software to use it online - websites have it
57. Slide 68: beep-beep!
58. Slide 70: If you’re going to write new code, why not OpenID code?
59. Slide 71: Benefits of OpenID • Only one interface to implement • And lots of expertise available globally • If website uses open.id.ee service exclusively, it has instant access to both ID-cards and Mobile-ID authentication • ... with privacy features included @ no cost
60. Slide 72: So ... • Users get more control over their private data and OpenID provides it • Websites have a simple and easy way to integrate newest authentication technologies with OpenID
61. Slide 73: Finally a win-win solution?
62. Slide 74: Almost there ...
63. Slide 75: Anonymity • Users want anonymity • At least partial • Remaining anonymous is a privilege • Spam, death threats etc must be punishable
64. Slide 76: The story • Riots in Tallinn that leaded to cyber-attacks • Petition letter to force a politician resign collected almost 100k names and e-mails • Including “George Bush”, “Rex the dog” and “!@#$ you” • Result: nothing.
65. Slide 77: OpenID 2.0 • New feature: identity selection • You get to choose the OpenID sent to the website • Choose between open.id.ee/martin.paljak ...
66. Slide 78: or http://open.id.ee/5a0eaba4bb1fb68a39ddec57c15dbff1543d6f461b2203f74
67. Slide 79: Anonymous OpenID • No (zero) personal data in the URL • One anonymous URL per user per website • The “account” problem mitigated • Still a guarantee that the user behind the OpenID is a real person
68. Slide 82: Extra Features • Identity theft virtually impossible • re-claiming is painless • Some registration data is always true • If user chooses to send it • “Why do they need it?”
69. Slide 83: Why do I Care? • I’m a user too! • We export the ID technology of Estonia • Online privacy issues are being discussed • Verified anonymity contributes to e-democracy
70. Slide 84: Why you should care! • Implement OpenID - get access to our technology • Other EU countries deploying ID-cards • Similar problems • Similar solutions • OpenID is designed for interoperability • ID-cards are in theory
71. Slide 85: Thanks! Questions? http://openid.net/ https://open.id.ee/about/english David Recordon Martin Paljak davidrecordon.com http://ideelabor.ee david@sixapart.com martin@ideelabor.ee