Securing Your Ecosystem (FOWA Las Vegas 2011)

Securing your ecosystem @raffihttp://www.flickr.com/photos/mklingo/

Speaking at @fowa! Let’s talk about securingecosystems & let’s talk @twitterapi!29 Jun via Twitter for iPhone from Meet, Las Vegas 233 South 4th Street Las Vegas, Nevada 89101 View Tweets at this place

>660K Developers on @twitterAPI

>900K Apps + The Official ones

>200M users on @twitter

Users are paramount http://www.flickr.com/photos/ilya/

Users need 2 things protected⇢ identity⇢ data http://www.flickr.com/photos/ilya/

Security is hard to bolt on “later” http://www.flickr.com/photos/ragzrejected/

Govern your ecosystemhttp://www.flickr.com/photos/mr_t_in_dc/

Case study in @twitterAPI

We used to be basic auth

raffi ← Username :totallysecure ← Password

Base64(raffi:totallysecure) cmFmZmk6dG90YWxseXNlY3VyZQ==

GET /secure HTTP/1.1Host: localhostAuthorization: Basic cmFmZmk6dG90YWxseXNlY3VyZQ==

The passwordantipattern

The carrot

further protect our users⇢ mandate the use of OAuth⇢ understand where our traffic is coming from

Thisconversion was a challenge

And... One more time, protect our users⇢ break out a new permissions model⇢ try to make it extremely clear to a user what apps are doing

Be reallyreally really(really) ∞explicit

Check back with me next year —i might be able to say how it went

What would I do if i were you?⇢ forget basic auth!⇢ go straight to OAuth 2⇢ understand your “problem”

Make sure to have the tools you need http://www.flickr.com/photos/11872189@N00/

Our Users @taylorswift13

Follow meQuestions? @raffi

http://tychong.umuc.edu	15
url_unknown	8
http://lindprof.blogspot.com	7
http://espeleotenerife.blogspot.com	7
http://www.slideshare.net	5
http://lanyrd.com	4
http://www.blogger.com	2
http://blog.slideshare.net	1
http://pmsapp.mercadolibre.com.ar	1

Securing Your Ecosystem (FOWA Las Vegas 2011)

by Raffi Krikorian

Accessibility

Categories

Upload Details

Usage Rights

9 Embeds 50

Statistics