1. François Marier – @fmarier
Taking the pain out of
signing users in

2. passwords

3. problem #1:
passwords are hard to secure

13. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

14. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

15. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

16. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

17. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery

18. bcrypt / scrypt / pbkdf2
per-user salt
site secret
password & lockout policies
secure recovery
2013
2013
password
password
guidelines
guidelines

19. passwords are hard to secure
they are a liability

20. ALTER TABLE user
DROP COLUMN password;

21. problem #2:
passwords are hard to remember

24. pick an easy password

25. use it everywhere

26. passwords are hard to remember
they need to be reset

28. control
email
account
control
all
accounts
=

30. “People want a little
dating before marriage.”
Eric Vishria – Rockmelt

32. decentralised

33. myid.com/u/francois

36. existing login systems
are not good enough

37. ideal web-wide identity system

38. ●
decentralised
simple
cross-browser
ideal web-wide identity system

39. ●
decentralised
●
simple
cross-browser
ideal web-wide identity system

40. ●
decentralised
●
simple
●
cross-browser
ideal web-wide identity system

41. what if it were a standard
part of the web browser?

43. how does it work?

44. fmarier@gmail.com

45. demo #1:
http://www.voo.st/
fmariertest@eyedee.me

46. Persona is already a
decentralised system

47. decentralisation is the answer, but it's not
a product adoption strategy

48. we can't wait for all domains
to adopt Persona

49. we can't wait for all domains
to adopt Persona
solution: a temporary
centralised fallback

50. demo #2:
http://sloblog.io/
fmariertest@aol.com

51. Persona already works
with all email domains

52. identity bridging

53. demo #3:
http://www.reasonwell.com/
fmariertest@yahoo.com

58. >= 8

59. Persona is decentralized,
simple and cross-browser

60. it's simple for users, but is it also
simple for developers?

62. <script src=”https://login.persona.org/include.js”>
</script>
</body></html>

63. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login', {assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

64. navigator.id.watch({
loggedInUser: "francois@mozilla.com"
onlogin: function (assertion) {
$.post('/login', {assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

65. navigator.id.watch({
loggedInUser: null
onlogin: function (assertion) {
$.post('/login', {assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

66. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login', {assertion: assertion},
function (data) {
window.location = '/home';
}
);
}
onlogout: function () {
window.location = '/logout';
}
});

67. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login', {assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

69. navigator.id.request()

73. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login', {assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

74. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login', {assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

75. def verify_assertion(assertion):
page = requests.post(
'https://verifier.login.persona.org/verify',
data={ "assertion": assertion,
"audience": 'http://123done.org'}
)
data = page.json
return data.status == 'okay'

76. def verify_assertion(assertion):
page = requests.post(
'https://verifier.login.persona.org/verify',
data={ "assertion": assertion,
"audience": 'http://123done.org'}
)
data = page.json
return data.status == 'okay'

77. def verify_assertion(assertion):
page = requests.post(
'https://verifier.login.persona.org/verify',
data={ "assertion": assertion,
"audience": 'http://123done.org'}
)
data = page.json
return data.status == 'okay'

78. {
status: “okay”,
audience: “http://123done.org”,
expires: 1344849682560,
email: “francois@mozilla.com”,
issuer: “login.persona.org”
}

79. {
status: “failed”,
reason: “assertion has expired”
}

82. navigator.id.logout()

83. navigator.id.watch({
loggedInUser: null,
onlogin: function (assertion) {
$.post('/login', {assertion: assertion},
function (data) {
window.location = '/home';
}
);
},
onlogout: function () {
window.location = '/logout';
}
});

85. 1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons
4. verify proof of ownership

86. 1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons
4. verify proof of ownership

87. 1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons
4. verify proof of ownership

88. 1. load javascript library
2. setup login & logout callbacks
3. add login and logout buttons
4. verify proof of ownership

89. you can add support for
Persona in four easy steps

90. one simple request

92. building a new site:
default to Persona

93. working on an existing site/app:
add support for Persona

94. To learn more about Persona:
https://login.persona.org/
http://identity.mozilla.com/
https://developer.mozilla.org/docs/Persona/Quick_Setup
https://github.com/mozilla/browserid-cookbook
https://developer.mozilla.org/docs/Persona/Libraries_and_plugins
http://123done.org/
https://wiki.mozilla.org/Identity#Get_Involved @fmarier

95. © 2013 François Marier <francois@mozilla.com>
This work is licensed under a
Creative Commons Attribution-ShareAlike 3.0 New Zealand License.
Hotel doorman: https://secure.flickr.com/photos/wildlife_encounters/8024166802/
Top 500 passwords: http://xato.net/passwords/more-top-worst-passwords/
Parchment: https://secure.flickr.com/photos/27613359@N03/6750396225/
Uncle Sam: https://secure.flickr.com/photos/donkeyhotey/5666065982/
Restaurant dinner: https://secure.flickr.com/photos/yourdon/3977084094/
Stop sign: https://secure.flickr.com/photos/artbystevejohnson/6673406227/
Photo credits: