Authentication without Authentication - Peerlyst meetup
•Download as PPTX, PDF•
0 likes•186 views
This document summarizes a presentation about authenticating devices without traditional authentication. It describes using digital signatures and one-time passwords to uniquely identify devices based on cryptographic keys. The presentation covers OpenID, digital signatures, one-time passwords, and demonstrates authenticating an API request without passwords. Edge cases like network failures and compromised devices are also addressed. Requirements for the authentication method are that it provides strong authentication, unique device identification, simplicity, unique requests, and fault tolerance.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Authentication without Authentication - Peerlyst meetup
Similar to Authentication without Authentication - Peerlyst meetup (20)
More from Soluto
More from Soluto (20)
Recently uploaded
Recently uploaded (20)
Authentication without Authentication - Peerlyst meetup
- 2. Agenda ● Introduction ● OpenID ● Digital Signature ● One Time Password ● Demo ● Edge Cases
- 3. Can we Authenticate without Authentication?
- 4. - Helping people get the most out of their technology
- 7. “...a significant amount of drop-off in app usage, losing up to 56% of users, but are pretty much essential for the majority of apps out there today...” Source: Optimizely
- 9. Authentication Requests Per Second
- 14. ● “Simple Identity Layer” ● Token-based authentication ● Widely supported ● Modularity - many authentication flows
- 16. Supported Authentication Methods Authorization/Implicit/Hybrid Client credentials Resource Owner JWT client assertion
- 17. We need a new authentication flow
- 20. Requirements ❏ Strong authentication solution ❏ Unique device identification ❏ Simple ❏ Unique per request ❏ Replay Attacks ❏ Fault tolerant
- 21. Questions?
- 22. Let’s use Digital Signature
- 23. Dear Bob Dear BobSign Verify Leo Bob the BuilderTM Source: Bob the Buildertm Official Site
- 25. How we can use it?
- 26. Authorization Server Device Public Key, Id Public Key, Id Id: 5467
- 27. Authorization ServerDevice Digital Signature, Id Public Key, Id Id: 5467
- 28. So far we have: ✓ Strong authentication solution ✓ Unique device identification ✓ Simple ❏ Unique per request ❏ Fault tolerant
- 29. Questions?
- 31. Authorization ServerDevice Digital Signature, Id Public Key, Id Id: 5467
- 32. Let’s build our own OTP
- 33. Client State Server State Old 5 New 2 Old 5 New 2 Old 2 New 42 Old 5 New 2 Old 2 New 42 Token
- 34. So far we have… ✓ Strong authentication solution ✓ Unique device identification ✓ Simple ✓ Unique per request ✓ Fault tolerant
- 35. Questions?
- 36. Demo Time
- 38. Let’s see it in action... All the code is available on GitHub
- 39. Network request can fail ● Reasons: ○ Timeout ○ Network failure ○ Temporary server errors ● Unknown server state ○ State did not changed ○ State changed
- 40. Client State Server State Old 2 New 42 Old 1 New 2 Old 2 New 42 Old 2 New 42 Old 1 New 2 Token Error
- 41. Client State Server State Old 2 New 42 Old 2 New 42 Old 1 New 2 Old 2 New 42Old 2 New 42Old 2 New 42 Error
- 42. Client State Server State Old 2 New 42 Old 2 New 42 Old 42 New 86 Old 42 New 86 Old 2 New 42 Bad Request (400) Token
- 43. Questions?
- 46. Client State Server State Old 2 New 42 Old 1 New 2 Eve Old 2 New 42 Old 1 New 2 Old 2 New 42 Old 2 New 42 Token
- 47. Client State Server State Old 2 New 42 Old 2 New 42 Eve Old 42 New 56 Old 2 New 42 Old 2 New 42 Bad Request (400)
- 48. Client State Server State Old 42 New 78 Old 2 New 42 Eve Old 42 New 56 Old 2 New 42 Old 42 New 78 Old 42 New 78Token
- 49. Client State Server State Old 78 New 4 Old 7 New 78 Eve Old 7 New 56 Old 7 New 78 Old 7 New 93 400 Bad Request
- 51. Questions?
- 52. Conclusion
- 54. Requirements ✓ Strong authentication solution ✓ Unique device identification ✓ Simple ✓ Unique per request ✓ Fault tolerant
- 57. How can you use it? @omerlh #MeetupAtSoluto