Os Recordontutorial

Slide 1: Bootcamp Simon Willison David Recordon simonwillison.net davidrecordon.com simon@simonwillison.net drecordon@verisign.com OSCON July 24th, 2007

Slide 2: Who are We? • David Recordon • VeriSign Employee since May of 2006 • OpenID Foundation Vice- Chair • Co-Author of various OpenID specifications • Past employee of Six Apart, where OpenID was created

Slide 3: Who are We? • Simon Willison • Ex-Yahoo!, now freelance • “Europe’s first OpenID consultant” • Co-creator of the Django Web Framework

Slide 4: The Plan • Basic concepts of OpenID • Hands on - Creating and using an OpenID • Adoption, history, and status • Security concerns • Break • Security solutions • Clever and creative hacks • OpenID in code • Q&A

Slide 5: What is OpenID?

Slide 6: OpenID is a decentralised mechanism for Single Sign On

Slide 7: What problems does it solve?

Slide 8: “Too many passwords!”

Slide 9: “Someone else already grabbed my username”

Slide 10: “My online profile is scattered across dozens of sites”

Slide 11: What is an OpenID?

Slide 12: An OpenID is a URI

Slide 13: http://swillison.livejournal.com/

Slide 14: http://simonw.myopenid.com/

Slide 15: http://openid.aol.com/simonwillison/

Slide 16: http://simonwillison.net/

Slide 17: What can you do with an OpenID?

Slide 18: You can claim that you own it

Slide 19: You can prove that claim

Slide 20: Why is that useful?

Slide 21: You can use it for authentication

Slide 22: “Who the heck are you?!” Login? Home | Main Schedule | Map | Mobile | About iCalico | Web 2.0 Expo Search Welcome to ExpoCal! Go Social calendaring for Web 2.0 Expo, April. 15-18, 2007. Build lists of interesting looking sessions, check out what your friends are going to see, or tag surf your way to serependity. My Schedule By Day You need to be logged in to keep a SUNDAY, APRIL 15, MONDAY, APRIL 16, WEDNESDAY, APRIL 18, TUESDAY, APRIL 17, 2007 list of talks and sessions you are 2007 2007 2007 interested in attending. Popular Today Popular Today Popular Today Popular Today \"Building Social \"Conference Welcome\" Tim \"Mobile 2.0\" Ajit Jaokar Mike \"Welcome\" Tim O'Reilly login | sign up Applications\" Stowe Boyd O'Reilly McCue; Ilkka Raiskinen; \"Jeff Weiner in Conversation \"High Performance \"A Conversation with Jeff Paola Tonelli with John Battelle\" Jeff Webpages\" Steve Bezos\" Jeffrey P. Bezos \"State of the Web 2.0: Weiner John B... Souders Tenni Theurer \"Built to Last or Built to Measuring the Participatory \"Web 2.0 for the Enterprise: Is \"Ignite\" Sell: Is There a Difference? Web\" Bill Tancer It Soup Yet?\" Dan Farber \" John Batt... \"Eric Schmidt in Conversation Satish Dha... Today: All with John Battelle\" Eric Today: All Today: All Schmidt John... Today: All Popular: Tags Popular: Speaker Community Design and User Ajit Jaokar Bill Tancer Brian Mulloy Charlene Ajax Li Dan Farber David Knight Dirk-Willem van Experience Keynotes Marketing Gulik Dmitry Dimov Eric Schmidt Ilkka and Community Strategy and Raiskinen James Baty Jay Adelson Jay Business Models Web 2.0 Bhatti Jeff Weiner Jeffrey P. Bezos Joe Fundamentals Web 2.0 Services John Battelle Kathy Sierra Kelly Kraus and Platforms Web Operations advertising Goto Kerry Fleming Kevin Lynch Luke Sontag business design digitalid django experience Mike McCue Mena Trott Paola Tonelli flickr free google javascript marketing microformats products and services Rich Skrenta Ross Mayfield Satish openid php Dharmaraj Subrah Iyar Tim O'Reilly rails search skypejournal social syndication all tags yahoo everybody! Random People ChrisC1971 alexiskold atomsplitter billvision brady emccm Everything! gervasio goodsboy gustav heinika hienhuynh hotwheel http://jalanoly.pip.verisignlabs.com/ Find: all talks, the all speakers, all tags, or users. http://suleyman.pip.verisignlabs.com/ http://vishnu.myopenid.com/ jessie jggaines leeclw maisany markgoines nborwankar pbuder philip ron_topright shameer shua slevine timknight tomas wilsonminer

Slide 23: “I’m simonwillison.net”

Slide 24: “prove it!” Login? Home | Main Schedule | Map | Mobile | About iCalico | Web 2.0 Expo Search Welcome to ExpoCal! Go Social calendaring for Web 2.0 Expo, April. 15-18, 2007. Build lists of interesting looking sessions, check out what your friends are going to see, or tag surf your way to serependity. My Schedule By Day You need to be logged in to keep a SUNDAY, APRIL 15, MONDAY, APRIL 16, WEDNESDAY, APRIL 18, TUESDAY, APRIL 17, 2007 list of talks and sessions you are 2007 2007 2007 interested in attending. Popular Today Popular Today Popular Today Popular Today \"Building Social \"Conference Welcome\" Tim \"Mobile 2.0\" Ajit Jaokar Mike \"Welcome\" Tim O'Reilly login | sign up Applications\" Stowe Boyd O'Reilly McCue; Ilkka Raiskinen; \"Jeff Weiner in Conversation \"High Performance \"A Conversation with Jeff Paola Tonelli with John Battelle\" Jeff Webpages\" Steve Bezos\" Jeffrey P. Bezos \"State of the Web 2.0: Weiner John B... Souders Tenni Theurer \"Built to Last or Built to Measuring the Participatory \"Web 2.0 for the Enterprise: Is \"Ignite\" Sell: Is There a Difference? Web\" Bill Tancer It Soup Yet?\" Dan Farber \" John Batt... \"Eric Schmidt in Conversation Satish Dha... Today: All with John Battelle\" Eric Today: All Today: All Schmidt John... Today: All Popular: Tags Popular: Speaker Community Design and User Ajit Jaokar Bill Tancer Brian Mulloy Charlene Ajax Li Dan Farber David Knight Dirk-Willem van Experience Keynotes Marketing Gulik Dmitry Dimov Eric Schmidt Ilkka and Community Strategy and Raiskinen James Baty Jay Adelson Jay Business Models Web 2.0 Bhatti Jeff Weiner Jeffrey P. Bezos Joe Fundamentals Web 2.0 Services John Battelle Kathy Sierra Kelly Kraus and Platforms Web Operations advertising Goto Kerry Fleming Kevin Lynch Luke Sontag business design digitalid django experience Mike McCue Mena Trott Paola Tonelli flickr free google javascript marketing microformats products and services Rich Skrenta Ross Mayfield Satish openid php Dharmaraj Subrah Iyar Tim O'Reilly rails search skypejournal social syndication all tags yahoo everybody! Random People ChrisC1971 alexiskold atomsplitter billvision brady emccm Everything! gervasio goodsboy gustav heinika hienhuynh hotwheel http://jalanoly.pip.verisignlabs.com/ Find: all talks, the all speakers, all tags, or users. http://suleyman.pip.verisignlabs.com/ http://vishnu.myopenid.com/ jessie jggaines leeclw maisany markgoines nborwankar pbuder philip ron_topright shameer shua slevine timknight tomas wilsonminer

Slide 25: (crypto happens)

Slide 26: “OK, you’re in!” Login? Home | Main Schedule | Map | Mobile | About iCalico | Web 2.0 Expo Search Welcome to ExpoCal! Go Social calendaring for Web 2.0 Expo, April. 15-18, 2007. Build lists of interesting looking sessions, check out what your friends are going to see, or tag surf your way to serependity. My Schedule By Day You need to be logged in to keep a SUNDAY, APRIL 15, MONDAY, APRIL 16, WEDNESDAY, APRIL 18, TUESDAY, APRIL 17, 2007 list of talks and sessions you are 2007 2007 2007 interested in attending. Popular Today Popular Today Popular Today Popular Today \"Building Social \"Conference Welcome\" Tim \"Mobile 2.0\" Ajit Jaokar Mike \"Welcome\" Tim O'Reilly login | sign up Applications\" Stowe Boyd O'Reilly McCue; Ilkka Raiskinen; \"Jeff Weiner in Conversation \"High Performance \"A Conversation with Jeff Paola Tonelli with John Battelle\" Jeff Webpages\" Steve Bezos\" Jeffrey P. Bezos \"State of the Web 2.0: Weiner John B... Souders Tenni Theurer \"Built to Last or Built to Measuring the Participatory \"Web 2.0 for the Enterprise: Is \"Ignite\" Sell: Is There a Difference? Web\" Bill Tancer It Soup Yet?\" Dan Farber \" John Batt... \"Eric Schmidt in Conversation Satish Dha... Today: All with John Battelle\" Eric Today: All Today: All Schmidt John... Today: All Popular: Tags Popular: Speaker Community Design and User Ajit Jaokar Bill Tancer Brian Mulloy Charlene Ajax Li Dan Farber David Knight Dirk-Willem van Experience Keynotes Marketing Gulik Dmitry Dimov Eric Schmidt Ilkka and Community Strategy and Raiskinen James Baty Jay Adelson Jay Business Models Web 2.0 Bhatti Jeff Weiner Jeffrey P. Bezos Joe Fundamentals Web 2.0 Services John Battelle Kathy Sierra Kelly Kraus and Platforms Web Operations advertising Goto Kerry Fleming Kevin Lynch Luke Sontag business design digitalid django experience Mike McCue Mena Trott Paola Tonelli flickr free google javascript marketing microformats products and services Rich Skrenta Ross Mayfield Satish openid php Dharmaraj Subrah Iyar Tim O'Reilly rails search skypejournal social syndication all tags yahoo everybody! Random People ChrisC1971 alexiskold atomsplitter billvision brady emccm Everything! gervasio goodsboy gustav heinika hienhuynh hotwheel http://jalanoly.pip.verisignlabs.com/ Find: all talks, the all speakers, all tags, or users. http://suleyman.pip.verisignlabs.com/ http://vishnu.myopenid.com/ jessie jggaines leeclw maisany markgoines nborwankar pbuder philip ron_topright shameer shua slevine timknight tomas wilsonminer

Slide 27: So it’s a bit like Microsoft Passport, then?

Slide 28: Yes, at a high level

Slide 29: But you don’t need to ask Microsoft’s permission to implement it

Slide 30: One organisation doesn’t get to own everyone’s credentials

Slide 31: And the standard isn’t owned by any one company or group

Slide 32: Who does get to own them?

Slide 33: You, the user, decide.

Slide 34: You pick your own provider

Slide 35: (just like e-mail)

Slide 36: So I’m still giving someone the keys to my kingdom?

Slide 37: Yes, but it can be someone you trust

Slide 38: If you have the ability to run your own server software, you can do it for yourself

Slide 39: We'll show you how to do that a little later on

Slide 40: OK, how do I use it?

Slide 45: So my users don’t have to sign up for an account?

Slide 46: Not necessarily

Slide 47: An OpenID tells you very little about a user

Slide 48: You don’t know their name

Slide 49: You don’t know their e-mail address

Slide 50: You don’t know if they’re a person or a spambot

Slide 51: (or a dog)

Slide 52: Where do I get that information from?

Slide 53: You ask them!

Slide 54: OpenID augments your regular sign-up process; it doesn't replace it

Slide 55: The simple registration extension can help users fill out your registration form

Slide 58: How can I tell if they’re an evil spambot?

Slide 59: Same as usual: challenge them with a CAPTCHA

Slide 60: botbouncer.com lets you outsource your CAPTCHAs

Slide 62: So how does OpenID actually work?

Slide 65: <link rel=\"openid.server\" href=\"http://www.myopenid.com/server\" />

Slide 66: “I’m simonwillison.myopenid.com”

Slide 67: Site fetches HTML, discovers identity provider

Slide 68: Establishes shared secret with identity provider (Using Diffie-Hellman key exchange)

Slide 69: Redirects you to the identity provider

Slide 70: If you’re logged in there, you get redirected back

Slide 71: How does my identity provider know who I am?

Slide 72: OpenID deliberately doesn’t specify

Slide 73: username/password is common

Slide 74: But providers can use other methods if they want to

Slide 75: Client SSL certificates

Slide 76: Out of band authentication via SMS, e-mail or Jabber

Slide 77: IP based login restrictions

Slide 78: SecurID keyfobs

Slide 79: The provider’s business is authentication: they can invest much more effort than regular sites

Slide 80: It’s also possible for a provider to just say “yes” to every query

Slide 81: Just say “yes”?

Slide 82: http://www.jkg.in/openid/ does this

Slide 83: Users can give away their passwords today - this is the OpenID equivalent

Slide 84: It's similar to bugmenot.com

Slide 85: What if I decide I hate my provider?

Slide 86: Use your own domain name

Slide 87: Delegate to a provider you trust

Slide 90: <link rel=\"openid.server\" href=\"http://www.livejournal.com/openid/server.bml\"> <link rel=\"openid.delegate\" href=\"http://swillison.livejournal.com/\">

Slide 91: This minimises lock in and ensures easy portability

Slide 92: So everyone will end up with one OpenID that they use for everything?

Slide 93: Probably not

Slide 94: (I have half a dozen OpenIDs already)

Slide 95: People like maintaining multiple online personas

Slide 96: professional social secret ...

Slide 97: OpenID makes it easier to manage multiple online personas

Slide 98: Three accounts is still better than three dozen

Slide 99: Some providers let you host multiple OpenIDs, or create a new one for every site you sign in to

Slide 100: Why is OpenID worth implementing over all the other identity standards?

Slide 101: It’s simple

Slide 102: Unix philosophy: It solves one, tiny problem

Slide 103: It’s a dumb network

Slide 104: Many of the competing standards are now on board

Slide 105: Isn’t putting all my eggs in one basket a really bad idea?

Slide 106: Bad news: chances are you already do

Slide 107: “I forgot my password” means your e-mail account is already an SSO mechanism

Slide 108: OpenID just makes this a bit more obvious

Slide 109: What about phishing?

Slide 110: Phishing is a problem

Slide 111: I can has lolcats!? BETA Make your own lolcats! lol Sign in with your OpenID: OpenID: Sign in http://icanhascheezburger.com/2007/05/16/i-has-a-backpack/

Slide 112: Fake edition Your identity provider Username and password, please! Username: Password: Log in

Slide 113: Identity theft :(

Slide 114: An untrusted site redirects you to your trusted provider

Slide 115: Sound familiar?

Slide 116: PayPal Yahoo! BBAuth Google Auth Google Checkout

Slide 117: We'll talk about some potential solutions later

Slide 118: Doesn’t this outsource the security of my users to untrusted third parties?

Slide 119: Yes it does. But...

Slide 120: ... so do “forgotten password” e-mails!

Slide 121: If e-mail is secure enough for your user’s authentication, so is OpenID

Slide 122: Password e-mails are essentially SSO with a bad user experience

Slide 123: What are the privacy implications?

Slide 124: Cross correlation of accounts

Slide 125: Don’t publish a user’s OpenID without making it clear that you’re going to do that

Slide 126: Allow users to opt-out of sharing their OpenID

Slide 127: The online equivalent of a credit reporting agency?

Slide 128: This could be built today by sites conspiring to share e-mail addresses

Slide 129: IANAL, but legal protections against this already exist

Slide 130: “Directed identity” in OpenID 2.0 makes it easy to use a different OpenID for every site

Slide 131: Patents?

Slide 132: Sun,VeriSign and JanRain have both announced “patent covenants”

Slide 133: They won’t smack you down with their patents for using OpenID 1.1

Slide 134: They will smack down anyone else who asserts their own patents against OpenID

Slide 135: The OpenID Foundation is working on an IPR Policy

Slide 136: Who else is involved?

Slide 137: ~120M OpenIDs

Slide 138: ~4200 RPs

Slide 139: AOL - provider, full consumer very soon

Slide 140: Microsoft: Bill Gates expressed their interest at the RSA conference

Slide 141: (mainly as good PR for CardSpace?)

Slide 142: Sun: Patent Covenant, 33,000 employees

Slide 143: VeriSign

Slide 144: Symantec

Slide 145: 37 Signals

Slide 146: Drupal

Slide 147: Plone

Slide 148: Rails

Slide 149: Six Apart

Slide 150: JanRain

Slide 151: ...etc we'll talk about this more later

Slide 152: The Plan • Basic concepts of OpenID • Hands on - Creating and using an OpenID • Adoption, history, and status • Security concerns • Break • Security solutions • Clever and creative hacks • OpenID in code • Q&A

Slide 153: Creating an OpenID pip.VeriSignLabs.com MyOpenID.com ClaimID.com FreeYourID.com http://openid.net/wiki/index.php/OpenIDServers and you may already have one

Slide 154: Using Your OpenID Basecamp.com Plaxo.com Blinksale.com Toodledo.com Wikispaces.com WikiTravel.com Ma.gnolia.com Jyte.com HighRiseHQ.com WetPaint.com http://intertwingly.net/blog/2007/01/03/OpenID-for-non-SuperUsers

Slide 155: The Plan • Basic concepts of OpenID • Hands on - Creating and using an OpenID • Adoption, history, and status • Security concerns • Break • Security solutions • Clever and creative hacks • OpenID in code • Q&A

Slide 156: 6 0 0 ~12 million OpenIDs 2 OpenID 1.1 - Estimated from various services

Slide 157: ~120 million OpenIDs (including every AOL user) OpenID 1.1 - Estimated from various services

Slide 158: 6 Total Relying Parties 0 (aka places you can login with OpenID) 0 y nt ou /B p i Sx 4,500 2 3,375 2,250 1,125 0 '05 ct ov ec '06 b ar r ay e ly g Ap Au n Fe Ju O M M D N Ju p Jan Se OpenID 1.1 - As viewed by MyOpenID.com

Slide 159: Total Relying Parties (aka places you can login with OpenID) po L AO y Ex nt ou 0 & 2. /B T SF eb p M W i Sx 4,500 3,375 2,250 1,125 0 '05 ct ov ec '06 b ar r ay e ly g p ct ov ec '07 b ar r ay e 22 Ap Ap Au n n Fe Se Fe Ju O O M M M M D D N Ju N Ju ly p Jan Jan Ju Se OpenID 1.1 - As viewed by MyOpenID.com

Slide 160: 6 0 0 2

Slide 162: History 2005 & 2006 Created by Brad Fitzpatrick (Summer 2005) Yadis Discovery protocol (Jan 2006) VeriSign launches OpenID Provider (May) Convergence with i-names (July) Convergence with Sxip (Aug.) $50,000 USD Developer Bounty (Aug.) Technorati adopts OpenID (Oct.) Tutorials by Simon Willison (Dec.)

Slide 163: History Q1 2007 Mozilla announces intent to support OpenID in FireFox 3 (Jan.) Microsoft support expressed by Bill Gates and Craig Mundie at RSA Conference keynote (Feb.) AOL add OpenID to every one of their ~60M accounts (Feb.) Symantec announces upcoming OpenID products (Feb.) Digg and NetVibes announce OpenID support (Feb.) Wordpress.com and 37Signals adopt OpenID (March) USA Today publishes OpenID article on the Money section front-page (March)

Slide 164: History Q2 2007 Plone 3.0 ships with OpenID support (May) Sun Microsystems adopts OpenID in enterprise product and provides employees with OpenID (May) livedoor adds OpenID support (May) OpenID wins Next Web Award (June) Leo Laporte and Steve Gibson discuss OpenID (June) OpenID wins CNET Webware 100 award (June) Atlassian (makers of enterprise wiki software) supports OpenID (June) Drupal 6 ships with OpenID support (June)

Slide 165: The OpenID Foundation

Slide 166: The purpose of the OpenID Foundation is to foster and promote the development and adoption of OpenID as a framework for user-centric identity on the Internet.

Slide 167: Founding board Scott Kveton David Recordon Chair Vice-Chair scott@kveton.com drecordon@verisign.com Dick Hardt Martin Atkins Treasurer Secretary dick@sxip.com mart@degeneration.co.uk Johannes Ernst Drummond Reed jernst@netmesh.us drummond.reed@cordance.net Bill Washburn Artur Bergman Executive Director sky@crucially.net bill@oidf.org

Slide 168: Current efforts Develop an IPR policy and process for OpenID specifications to keep OpenID free and patent unencumbered Develop a trademark policy that supports the extended OpenID community Develop core messaging for OpenID and websites oriented toward developers, users, and other potential adopters Coordinate World-wide joint marketing and evangelism

Slide 169: OpenID Auth 2.0 • Implementors draft published earlier this year • Already seen multiple implementations in PHP, Java, Perl, and Python • Concerns raised from service providers the size of AOL, LiveDoor,Yahoo! around identifier recycling • Still really close to a final specification

Slide 170: The Plan • Basic concepts of OpenID • Hands on - Creating and using an OpenID • Adoption, history, and status • Security concerns • Break • Security solutions • Clever and creative hacks • OpenID in code • Q&A

Slide 171: Protocol Security • DNS Security • Man in the Middle Attacks • Eavesdropping Attacks • MAC Key Weakness • Replay Attacks Don't Panic

Slide 172: Phishing An untrusted site redirects you to your trusted provider Not just a problem for OpenID, but also for PayPal, Google Auth and Checkout, Yahoo! BBAuth, AOL OpenAuth

Slide 173: Passwords Can be Stolen • Browsers have poor support for other means • Users normally ignore browser chrome • What extent are they willing to go? • \"Gang Kidnaps Gamer to Get Password Using Fake Orkut Date\"

Slide 174: Trust \"Trust first requires identity\" - Brad Fitzpatrick OpenID does not tell you if a user is good, bad, or even human • What if I've never seen the user before? • What if I know nothing about the OpenID Provider?

Slide 175: Decoupled Authentication • What if the user didn't authenticate at all? • How do I know if they met my policies? • I need strong authentication! • The user must authenticate within the past five minutes!

Slide 176: The Plan • Basic concepts of OpenID • Hands on - Creating and using an OpenID • Adoption, history, and status • Security concerns • Break • Security solutions • Clever and creative hacks • OpenID in code • Q&A

Slide 177: The Plan • Basic concepts of OpenID • Hands on - Creating and using an OpenID • Adoption, history, and status • Security concerns • Break • Security solutions • Clever and creative hacks • OpenID in code • Q&A

Slide 178: Protocol security • Use SSL correctly throughout the protocol • Protects against man-in-the-middle, eavesdropping attacks, and DNS attacks • Generate strong MAC keys and re-negotiate as needed • Used to verify data integrity and authenticity of OpenID responses • Verify NONCEs • Protects against replay attacks

Slide 179: Trust \"Trust first requires identity\" - Brad Fitzpatrick • Challenge them via a CAPTCHA or email verification • Even a distributed CAPTCHA • Use whitelists and blacklists • Ask someone else whom you trust

Slide 180: Decoupled authentication • OpenID Provider Authentication Policy Extension, draft published June 2006 • Relying Parties can ask for authentication policies such as \"phishing resistant\" or \"multi-factor\" • Providers can respond with policies the user complied with, time since they authenticated, and strength of the credential (s) used per NIST guidelines • Still has the question of \"trust\"

Slide 181: Whitelisting Providers • OpenID doesn't dictate that a RP accept every OpenID • Certainly most do • Might make sense for a bank to whitelist • Others sites by whitelisting will only hurt themselves by cutting down the number of users who can sign in • With Yadis Discovery, a user can list multiple providers and a RP can choose which to use

Slide 182: Vidoop (changes the metaphor by removing passwords)

Slide 183: DEMO

Slide 187: Client Side SSL Certificates

Slide 188: DEMO

Slide 192: Microsoft CardSpace (anti-phishing authentication built into the OS)

Slide 193: DEMO

Slide 200: VeriSign's OpenID SeatBelt (an OpenID convenience and security add-on for Firefox) works with

Slide 201: SeatBelt • Provide contextual information • Am I currently logged in and if so as whom? • Is it safe to login? • Remove phishing opportunities • Login when my browser opens • Take me to my Provider if I'm not logged in • Protect against common attacks • Validate SSL certificates when interacting with my Provider

Slide 202: DEMO

Slide 203: Provide context

Slide 204: Remove opportunities

Slide 205: Protect

Slide 206: the best solutions will be in the browser

Slide 207: Mozilla has said FireFox 3 will include some sort of OpenID integration

Slide 208: IE Team has posted a job ad mentioning \"OpenID\" \"Does the idea of redefining the role of the Internet browser appeal to you? Do the terms HTTP, RSS, Microformats, and OpenID, excite you? If so, then this just might be the opportunity for you.\"

Slide 209: The Plan • Basic concepts of OpenID • Hands on - Creating and using an OpenID • Adoption, history, and status • Security concerns • Break • Security solutions • Clever and creative hacks • OpenID in code • Q&A

Slide 210: Simplified account creation • The classic OpenID use-case: allow users to create a regular account on your system tied to their OpenID • Use Simple Registration to pre-fill the signup form • Let users associate one or more OpenIDs with an existing account

Slide 211: Lightweight accounts • Sometimes you just need persistent cookies • Personalisation • Preference saving • Anything where users can’t spam you • http://oscon07.icalico.org/ is a nice example

Slide 212: Simplified OpenID login • Millions of people have OpenIDs but don’t know what OpenID is • Offer them a sign-in form specific to their provider • Construct the OpenID behind the scenes

Slide 214: Internal SSO • Restrict your internal applications to only accept corporate assigned OpenIDs • Requires an internal OpenID server • Wikis, bug trackers, blog engines... • Applications need to be able to whitelist OpenIDs that match a certain pattern • http://(\\w+).internal.example.com/

Slide 215: Portable contact lists • Re-adding your friends on every social network completely sucks • The Facebook platform shows the importance of being able to build even trivial applications on top of an existing network • An OpenID is globally unique; it’s the ideal hook for building a reusable friend list

Slide 216: Contact list options • FOAF • RDF format, exported by LiveJournal • Currently adding a new “openid” field • XFN • Microformat for listing relationships • Can be embedded directly in HTML

Slide 217: http://daveman692.livejournal.com/data/foaf ... <foaf:knows> <foaf:Person> <foaf:nick>bradfitz</foaf:nick> <foaf:member_name>Brad Fitzpatrick</foaf:member_name> <foaf:tagLine></foaf:tagLine> <foaf:image>http://userpic.livejournal.com/21628/1</foaf:image> <rdfs:seeAlso rdf:resource=\"http://bradfitz.livejournal.com/data/foaf\" /> <foaf:weblog rdf:resource=\"http://bradfitz.livejournal.com/\"/> </foaf:Person> </foaf:knows> ...

Slide 218: http://gmpg.org/xfn/intro <ul> <li><a href=\"http://jane-blog.example.org/\" rel=\"date met\">Jane</a></li> <li><a href=\"http://dave-blog.example.org/\" rel=\"friend met\">Dave</a></li> <li><a href=\"http://darryl-blog.example.org/\" rel=\"friend met\">Darryl</a></li> </ul>

Slide 219: Pre-approved accounts • Collaboration apps (private wikis, multi- author blogs, Google Docs etc) often let you “invite” new members to your project • With OpenID, you can pre-approve their ability to log in without needing to create them a username and password

Slide 220: Social whitelists • A potential mechanism for tackling blog comment spam • Create a list of OpenIDs that can skip your spam filter • Share that list with your friends • Allow people on their lists to skip your spam filters as well • http://simonwillison.net/2007/Jan/22/whitelisting/

Slide 221: Group syndication • A combination of social whitelisting and pre- approved accounts • Syndicate groups as a list of OpenIDs • www.jyte.com does this • Tell another application that “anyone who is a member of that group can sign in”

Slide 223: jyte.com/api/group/djangonauts/roster http://www.jacobian.org/ http://groovymother.com/ http://rodbegbie.sxipper.com/ http://cygnus.myopenid.com/ http://www.b-tree.org/ http://root.b-tree.org/ http://jlam.idproxy.net/ http://claimid.com/jlam http://openid.aol.com/jlameudaemon http://jlam.vox.com/ http://jlam.livejournal.com/ http://adamh.openid.pl/ http://robhudson.myopenid.com/ http://recombiant.com/public/yadis.xrdf http://bradpitcher.livejournal.com/ http://kristate.myopenid.com/ http://michele.campeotto.net/ http://mderk.livejournal.com/ http://meangrape.myopenid.com/ http://telenieko.com/ http://eas.myopenid.com/ http://geekfun.livejournal.com/ http://www.pauladamsmith.com/ http://teknico.myopenid.com/ http://adamendicott.com/ http://simonwillison.net/ http://azuer88.myopenid.com/ http://lightlan.myopenid.com/

Slide 224: Provider-specific services • OpenIDs from different providers can tell you different things about a user • An AOL OpenID “proves” their IM details • A LiveJournal OpenID lets you discover their RSS, FOAF and LJ Jabber account • A last.fm OpenID could indicate their taste in music • Another reason to allow multiple OpenIDs to be associated with a single account

Slide 225: Identity projection • A related concept • OpenID lets you project your identity from one service to another • If you can prove to site X that you are a user of site Y, what new things can you build? • Lots of opportunities for interesting mashups here

Slide 226: Build a decentralised reputation network • eBay users build up a trusted reputation over time • Imagine if reputation could be tied to an OpenID, and aggregated by crawlers • This wouldn’t punish the bad guys (who would just get a new OpenID), but it would reward the good guys • Jyte lets you vote on claims about OpenIDs

Slide 229: Being a consumer and a provider • Not as crazy as you might think • Letting users sign in with OpenID is a no- brainer • Providing OpenID as a way of proving ownership of a profile page is also useful • You could even automatically delegate to the OpenID that they used to sign in

Slide 230: Proxies for proprietary authentication APIs • Google,Yahoo! and Facebook all provide proprietary authentication APIs • If they're supporting an authentication API, why don't they just support OpenID? • You can set yourself up as a proxy between their protocol and OpenID

Slide 232: The Plan • Basic concepts of OpenID • Hands on - Creating and using an OpenID • Adoption, history, and status • Security concerns • Break • Security solutions • Clever and creative hacks • OpenID in code • Q&A

Slide 233: Detailed protocol flow

Slide 234: associate • Back-channel between RP and Provider • Used to establish a shared secret used for message signing • HMAC style key calculated with SHA1 or SHA256 • Can use Diffie-Hellman or be in the clear if using SSL

Slide 235: checkid_setup • Front-channel via browser redirects • Send the user to their Provider with an OpenID request • Provider authenticates and prompts user • Responds with a \"yes\" or \"cancel\"

Slide 236: checkid_immediate • Front-channel via browser redirects • Send the user to their Provider with an OpenID request • Provider immediately responds with a \"yes\" or \"no\" • Good for AJAX type setups or \"single logout\"

Slide 237: check_authentication • Back-channel between RP and Provider • Used to verify a signature if there was not an existing association • Also used to verify a signature if the Provider told the RP to invalidate the existing association

Slide 238: As a drawing http://leancode.com http://www.windley.com

Slide 239: Creating an OpenID with your own server

Slide 241: * *************************************************************************** * * CONFIGURATION * *************************************************************************** * * You must change these values: * auth_username = login name * auth_password = md5(username:realm:password) * * Default username = 'test', password = 'test', realm = 'phpMyID' */ #$profile = array( # 'auth_username' => 'test', # 'auth_password' => '37fa04faebe5249023ed1f6cc867329b' #); /* * Optional - Simple Registration Extension: * * If you would like to add any of the following optional registration * parameters to your login profile, simply uncomment the line, and enter the * correct values. * * Details on the exact allowed values for these paramters can be found at: * http://openid.net/specs/openid-simple-registration-extension-1_0.html */ #$sreg = array ( # 'nickname' => 'Joe', # 'email' => 'joe@example.com', # 'fullname' => 'Joe Example', # 'dob' => '1970-10-31', # 'gender' => 'M', # 'postcode' => '22000', # 'country' => 'US', # 'language' => 'en', # 'timezone' => 'America/New_York' #);

Slide 243: * *************************************************************************** * * CONFIGURATION * *************************************************************************** * * You must change these values: * auth_username = login name * auth_password = md5(username:realm:password) * * Default username = 'test', password = 'test', realm = 'phpMyID' */ $profile = array( 'auth_username' => 'david', 'auth_password' => 'e0fee9a99fa2fe004bbd70b972a03aa1' ); /* * Optional - Simple Registration Extension: * * If you would like to add any of the following optional registration * parameters to your login profile, simply uncomment the line, and enter the * correct values. * * Details on the exact allowed values for these paramters can be found at: * http://openid.net/specs/openid-simple-registration-extension-1_0.html */ #$sreg = array ( # 'nickname' => 'Joe', # 'email' => 'joe@example.com', # 'fullname' => 'Joe Example', # 'dob' => '1970-10-31', # 'gender' => 'M', # 'postcode' => '22000', # 'country' => 'US', # 'language' => 'en', # 'timezone' => 'America/New_York' #);

Slide 244: Configure Profile Data $profile = array( 'auth_username' => 'david', 'auth_password' => 'e0fee9a99fa2fe004bbd70b972a03aa1' ); /* * Optional - Simple Registration Extension: * * If you would like to add any of the following optional registration * parameters to your login profile, simply uncomment the line, and enter the * correct values. * * Details on the exact allowed values for these paramters can be found at: * http://openid.net/specs/openid-simple-registration-extension-1_0.html */ $sreg = array ( 'nickname' => 'daveman692', 'email' => 'recordond@gmail.com', 'fullname' => 'David Recordon', 'dob' => '1986-09-04', 'gender' => 'M', 'postcode' => '941458', 'country' => 'US', 'language' => 'en', 'timezone' => 'America/Los_Angeles' );

Slide 246: Configure Delegation (source of www.davidrecordon.com) <html xmlns=\"http://www.w3.org/1999/xhtml\"> <head> <title>David Recordon</title> <style> div {