OpenID Foundation's Risk Incident and Sharing Communication (RISC) ...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Confidential + ProprietaryConfidential + Proprietary
Risk and Incident Sharing and
Coordination Legal Agreement Meeting
Lu...

Confidential + Proprietary
Agenda
[1:00 - 1:15] Intros
[1:15 - 1:45] RISC Overview
[1:45 - 2:30] Defining the goals of the...

Confidential + ProprietaryConfidential + Proprietary
Overview

Confidential & Proprietary
We seem to be losing against the bad guys

Confidential + Proprietary
Connected Accounts
● Email and phone number recovery creates an implicit relationship
● Federat...

Confidential + Proprietary
● Protect our shared users’ accounts across the Internet
● Protect our shared users’ data while...

Confidential + ProprietaryConfidential + Proprietary
The Problem

Confidential + Proprietary
An exploit at one service often leads to hacks elsewhere
● Attackers use account recovery mecha...

Confidential + Proprietary
Example: Hijacking

Confidential + Proprietary
Hijackers find a way in

Confidential + Proprietary
… and spread

Confidential + Proprietary
Example: Spam

Confidential + Proprietary
Spam can be more or less noticeable

Confidential + Proprietary
SSO makes it easy for you to get into 3P accounts

Confidential + Proprietary
SSO’s Fatal Flaw

Confidential + Proprietary
SSO’s Fatal Flaw

Confidential + Proprietary
Easy to hijack, hard to evict

Confidential + Proprietary
A solution is needed
Users can’t evict an attacker from a session bootstrapped with SSO
...but ...

Confidential + ProprietaryConfidential + Proprietary
The Solution

Confidential + Proprietary
Sharing important security events across providers
Risk and Incident Sharing and Coordination WG

Confidential + Proprietary
Defenses grow to match attack surface

Confidential + Proprietary
How is this done technically?
● Security Events standards set by the Internet Engineering
Task ...

Confidential + Proprietary
How is our users’ information shared?
● RISC signals are sent only to
the apps that we know the...

Confidential + Proprietary
Where you come in!
● Standardized trust framework for sharing
○ Common scope
○ Mutual terms
● P...

Confidential + Proprietary
How? A Contract!
● Required to join trusted tester group
○ Pre-launch period until ~April
● To ...

Confidential + ProprietaryConfidential + Proprietary
Google’s Plan

Confidential + Proprietary
How do we know the user’s apps?
Explicit
via OAuth
Implicit
registered via API
Request RISC for...

Confidential + Proprietary
Google + Contract
● Google will:
○ Treat this agreement as final
○ Share indiscriminately with ...

Confidential + ProprietaryConfidential + Proprietary
The Data

Confidential + Proprietary
● State Changes!
○ Account disabled/enabled/deleted
○ Tokens/Sessions revoked
○ Credentials/Ide...

Confidential + Proprietary
Signals in Scope
Account Status Events
● account_disabled
● account_disabled
○ reason=hijacking...

Confidential + Proprietary
Up Next
[2:45 - 3:00] Review the current draft
[3:00 - 3:30] Feedback on the current draft
[3:3...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1026982 views
Storytelling For The Web: Integrate... by Chiara Aliotta 937145 views
Artificial Intelligence, Data and C... by OECD Directorate ... 853259 views
How to Leverage AI to Boost Employe... by SocialHRCamp 357183 views
2024 State of Marketing Report – by... by Marius Sescu 203199 views
Everything You Need To Know About C... by Expeed Software 224364 views

View on Slideshare

1 of 32 Ad

View on Slideshare

1 of 32 Ad