Implimenting Privacy: OAuth and Token Madness

Implementing Privacy OAuth & Token Madness evan@protest.net

Privacy

Perception of Privacy

The Privacy to Disappear

Extreme Privacy

Privacy and the State

Privacy and the Law

Can you say? source: http://www.crestpublishing.co.za/killthepresident.html

Kill the Cuban president? source: http://ﬂic.kr/p/RfwD

Speech as Property

Privacy & Hackers

Email & Logins

One email per person

Email for Everything

We use email for everything!

Hackers want your email

The Twitter Files

Dear God Why?!?!

Salvation?

Delegated Token Authorization

Delegated Token Authorization FlickrAuth, Google AuthSub, Yahoo’s BBAuth, Facebook Auth, Amazon AWS, AOL OpenAuth, etc...

Tokens

Like Coins?

Symbols

username password token secret

timoreilly password token secret

timoreilly alphag33ks token secreto

timoreilly alphag33ks SLx39nv4 secreto

timoreilly alphag33ks SLx39nv4 L9vQlviq2x

Cryptographic Signatures

Cryptographic Signatures consumer = Auth::Consumer.new( 'dpf43f3p2l4k3l03', 'kd94hf93k423kf44' ) token = Auth::Token.new( 'nnch734d00sl2jdk', 'pfkkdhi9sl3r4s00' ) signature = Auth::Signature.sign(request, { :consumer => consumer, :token => token, :uri => 'http://photos.example.net/photos' } ) assert_equal 'tR3+Ty81lMeYAr/Fid0kMTYa/WM=', signature

Cryptographic WHAT? TOKEN HASH KEY SECRET

Cryptographic WHAT? TOKEN HASH KEY SECRET signature

Cryptographic WHAT? TOKEN HASH KEY SECRET signature sig=aslkdjfalskd

Cryptographic WHAT? TOKEN HASH KEY SECRET signature token=vkzljxc&sig=aslkdjfalskd

Delegated Token Authorization FlickrAuth, Google AuthSub, Yahoo’s BBAuth, Facebook Auth, Amazon AWS, AOL OpenAuth, etc...

Authentication Authorization

Authentication Authorization OpenID OAuth

Authentication Authorization OpenID OAuth Users Applications

Very Simple

Love Triangle end user consumer service application provider

Three Legs end user consumer service application provider

Two Legs consumer service application provider

Buenos Aires, Argentina San Jose, California

Token Dance consumer provider

Token Dance consumer provider requesting the request token

Token Dance consumer provider requesting the request token creates and returns a new request token

Token Dance consumer provider requesting the request token creates and returns a new request token redirect user to provider with token in url

Token Dance consumer provider requesting the request token creates and returns a new request token redirect user to provider with token in url user selects preferences and approves auth

Token Dance consumer provider requesting the request token creates and returns a new request token redirect user to provider with token in url user selects preferences and approves auth redirected back to consumer with request token

Token Dance consumer provider requesting the request token creates and returns a new request token redirect user to provider with token in url user selects preferences and approves auth redirected back to consumer with request token consumer wants to trade request token for access

Token Dance consumer provider requesting the request token creates and returns a new request token redirect user to provider with token in url user selects preferences and approves auth redirected back to consumer with request token consumer wants to trade request token for access provisional request token traded for access token

Token Dance consumer provider requesting the request token creates and returns a new request token redirect user to provider with token in url user selects preferences and approves auth redirected back to consumer with request token consumer wants to trade request token for access provisional request token consumer saves the traded for access token access token for the user

Token Dance web applications desktop applications out of band applications like mobile and embedded

OAuth Params oauth_*

OAuth Params oauth_consumer_key oauth_consumer_secret

OAuth Params oauth_consumer_key="dpf43f3p2l4k3l03" oauth_token="nnch734d00sl2jdk"

OAuth Params oauth_nonce="kllo9940pd9333jh" oauth_timestamp="1191242096"

OAuth Params oauth_signature_method="HMAC-SHA1" oauth_version="1.0" oauth_signature="tRMTYa%2FWM%3D"

Forms of OAuth HTTP GET params HTTP POST params HTTP Headers XMPP - Jabber

HTTP GET params GET&http%3A%2F%2Fphotos.example.net %2Fphotos&ﬁle%3Dvacation.jpg %26oauth_consumer_key %3Ddpf43f3p2l4k3l03%26oauth_nonce %3Dkllo9940pd9333jh%26oauth_signature_method %3DHMAC-SHA1%26oauth_timestamp %3D1191242096%26oauth_token%3Dnnch734d00sl2jdk %26oauth_version%3D1.0%26size%3Doriginal

HTTP HEADERS params GET /photos?size=original&ﬁle=vacation.jpg HTTP/1.1 Host: photos.example.net:80 Authorization: OAuth realm="http://photos.example.net/ photos" oauth_consumer_key="dpf43f3p2l4k3l03" oauth_token="nnch734d00sl2jdk" oauth_nonce="kllo9940pd9333jh" oauth_timestamp="1191242096" oauth_signature_method="HMAC-SHA1" oauth_version="1.0" oauth_signature="tR3%2BTy81lMeYAr%2FFid0kMTYa %2FWM%3D"

HTTP POST params POST /photos?size=original&ﬁle=vacation.jpg HTTP/1.1 Host: photos.example.net:80 oauth_consumer_key="dpf43f3p2l4k3l03" oauth_token="nnch734d00sl2jdk" oauth_nonce="kllo9940pd9333jh" oauth_timestamp="1191242096" oauth_signature_method="HMAC-SHA1" oauth_version="1.0" oauth_signature="tR3%2BTy81lMeYAr%2FFid0kMTYa %2FWM%3D"

Ignore the details source: http://ﬂic.kr/p/5NRADb

Libraries

Gems sudo gem install oauth github.com/mojodna/oauth

Plugins

Plugins ./script/plugin install git:// github.com/pelle/oauth-plugin.git github.com/pelle/oauth-plugin

OAuth on Rails rails osconrails -m rails-base-template.text cd osconrails ./script/plugin install git://github.com/pelle/oauth-plugin.git

Add the oauth-plugin ./script/generate oauth-plugin exists app/models/ create app/views/oauth create app/views/oauth_clients create app/models/client_application.rb create app/models/oauth_token.rb create app/models/request_token.rb create app/models/access_token.rb create app/models/oauth_nonce.rb create app/controllers/oauth_controller.rb create app/helpers/oauth_helper.rb create app/controllers/oauth_clients_controller.rb create app/helpers/oauth_clients_helper.rb create spec/models/client_application_spec.rb create spec/models/oauth_token_spec.rb create spec/models/oauth_nonce_spec.rb create spec/fixtures/client_applications.yml create spec/fixtures/oauth_tokens.yml create spec/fixtures/oauth_nonces.yml create spec/controllers/oauth_controller_spec_helper.rb create spec/controllers/oauth_controller_spec.rb create spec/controllers/oauth_clients_controller_spec.rb create app/views/oauth_clients/_form.html.erb create app/views/oauth_clients/new.html.erb create app/views/oauth_clients/index.html.erb create app/views/oauth_clients/show.html.erb

Update your routes ./conﬁg/routes.rb map.resources :oauth_clients map.authorize '/oauth/authorize',:controller=>'oauth',:action=>'authorize' map.request_token '/oauth/request_token',:controller=>'oauth',:action=>'request_token' map.access_token '/oauth/access_token',:controller=>'oauth',:action=>'access_token' map.test_request '/oauth/test_request',:controller=>'oauth',:action=>'test_request'

Filters for access control class ApiController < ApplicationController before_filter :login_or_oauth_required, :except => [:oauth_only_action] before_filter :oauth_required, :only => [:oauth_only_action]

That’s it!

Desert

Careful: nonce & timestamp

Careful: nonce & timestamp source: http://ﬂic.kr/p/QtskX

Use separate DB’s source: http://ﬂic.kr/p/6xtHZp

Signing with keys

Without Login

Privacy Wall

Privacy and the Law

Expire Tokens

CSRF & XSS - Careful!

Don’t Log Everything source: http://ﬂic.kr/p/5VcQWT

Selective Logging source: http://ﬂic.kr/p/5Zkwex

dev.riseup.net/privacy/ source: http://dev.riseup.net/privacy/

Except Telephony source: http://ﬂic.kr/p/4DzMNu

Privacy is Freedom source: http://ﬂic.kr/p/5anoq

Implementing Privacy OAuth & Token Madness evan@protest.net

Creative Commons Photos http://fireeagle.yahoo.net/developer/documentation/oauth_best_practice http://www.flickr.com/photos/stevenh/360015104/ http://www.flickr.com/photos/cdevers/2785041073/ http://www.flickr.com/photos/myklroventine/3355106480/ http://www.flickr.com/photos/itsallaboutmich/498340461/ http://www.flickr.com/photos/charlesfred/100392094/ http://www.flickr.com/photos/purplemattfish/3126383038/ http://www.flickr.com/photos/exlibris/1579580258/ http://www.flickr.com/photos/57231735@N00/212544472/ http://www.flickr.com/photos/maniya/541287799/ http://www.flickr.com/photos/santos/1704875109/ http://www.flickr.com/photos/alphadesigner/354044811/ http://www.flickr.com/photos/roby72/553640207/ http://www.flickr.com/photos/smb_flickr/392254853/ http://www.flickr.com/photos/eatingchips/3345052094 http://www.flickr.com/photos/koluso/2808523989/ http://www.flickr.com/photos/lwr/60496147/ http://www.flickr.com/photos/razowsky/2630970947/ http://www.flickr.com/photos/crazyneighborlady/355232758/ http://www.flickr.com/photos/mwichary/2648035941/ http://www.flickr.com/photos/zanotti/304312092/

Implimenting Privacy: OAuth and Token Madness

by Rabble . on Jul 23, 2009

Accessibility

Categories

Tags

Upload Details

Usage Rights

2 Embeds 42

Statistics

Implimenting Privacy: OAuth and Token Madness — Presentation Transcript

http://www.slideshare.net	39
http://moonrank.blogspot.com	3