TECHNICAL CONSIDERATIONS:
ETIQUETTE & BEST PRACTICES:
IMPORTANT INFO - DO NOT DELETE
WebID
Privacy and Identity Federation on the Web
BlinkOn 13�Ken Buchanan (kenrb@chromium.org)
your@email.com
******
Sign-in with A
Sign-in with B
Sign Up
or
Create an account with
https://example.com
forgot password
Federation is Safer Than Usernames/Passwords
Browser
RP
IDP
phishing, credential stuffing, password reuse
Two factor authentication, password-less single sign-on
your@email.com
******
Sign-in with A
Sign-in with B
Sign Up
or
Create an account with
https://example.com
forgot password
your@email.com
******
Sign-in with A
Sign-in with B
Sign Up
or
Create an account with
https://example.com
forgot password
Pop up blocked
example.com wants to open a new window to a.com, but we blocked.
allow
Reliance on General-purpose Web Primitives
Browser
RP
IDP
Reliance on General-purpose Web Primitives
Third-Party Cookie Access
Browser
RP
IDP
your@email.com
******
Sign Up
https://example1.com
Sam Goto�samuelgoto@gmail.com
Sign-in to example.com with IDP
Continue as Sam
forgot password
your@email.com
******
Sign Up
https://example2.com
Sam Goto�samuelgoto@gmail.com
Sign-in to example.com with IDP
Continue as Sam
forgot password
Navigational/Bounce Tracking and Link Decoration
Browser
RP
Tracker
https://rings.com
Engagement Rings!
Buy
US$ 1000
https://shoes.com
Engagement Shoes!
Buy
US$ 32
https://tracker.com
Redirecting you ...
https://tracker.com
Redirecting you ...
User 123 viewed engagement rings
User 123 viewed engagement shoes
....
Sign-in with A
https://example1.com
Sign-in with B
Sign-in with A
https://example2.com
Sign-in with B
Yes
Welcome Sam!��Are you trying to create an account with example.com?
https://a.com
Sam Goto�samuelgoto@gmail.com
Sam Goto�samuelgoto@gmail.com
Sam Goto�samuelgoto@gmail.com
Sam Goto�samuelgoto@gmail.com
Sam Goto�samuelgoto@gmail.com
Sam Goto�samuelgoto@gmail.com
global identifiers
RP Consequences of Web Identity
Browser
RP
IDP
Tracker
IDP Consequences of Federated Sign-in
your@email.com
******
Sign-in with A
Sign-in with B
Sign Up
or
Create an account with
https://example.com
Yes
Welcome Sam!��Here are the sites you’ve logged in this week:
https://b.com
forgot password
Navigate��Referer:� https://example.com
Browser
RP
IDP
WebID Proposals for Sign-In / Sign-Up
Project Goal
Develop a web API that allows enables existing federation flows to continue working for users, RPs and IdPs while improving user privacy and control of their personal information.
Please note that this project is in very early stages and everything below is still considered exploratory.
Complex Trade-offs
Usability
Developer Control
Ease of Deployment
Privacy Properties
Use Case Coverage
Sign-in with A
https://example1.com
Sign-in with B
Sign-in with A
https://example2.com
Sign-in with B
Yes
Welcome Sam!��Are you trying to create an account with example.com?
https://idp.com
Sam Goto�samuelgoto@gmail.com
Sam Goto�samuelgoto@gmail.com
?
Sam Goto�samuelgoto@gmail.com
Sam G.�asjlkd234@gmail.com
Sam Goto�samuelgoto@gmail.com
Sam G.�32wer2343@gmail.com
Directed Identifiers
Browser
RP
IDP
Verifiably Directed Identifiers
SHA256(IDP_ID + RP + NONCE)
Precise API shape not settled
async function signInWithIDP() {
navigator.id.get(
{
provider: [ ‘https://accounts.idp.example’ ],
request: { response_type: code,
client_id: 4e8sj09jj105,
state: 0ac879ed,
destination: https://rp.example }
})
.then(response => validateIDToken(response))
.catch(err => handleError(err));
}
How much intermediation?
UA
RP
your@email.com
******
IDP1
IDP2
Sign Up
or
Welcome!
https://example.com
forgot password
your@email.com
******
Sign Up!
or
Welcome!
https://example.com
Use your accounts.idp.com profile to sign into example.com and create an account with the information below:
Share my email
NAME
Sam Goto
Sign in with https://accounts.idp.com
continue
samuelgoto@gmail.com
IDP
Forward to:
samuelgoto@gmail.com
cancel
your@email.com
******
Sign Up!
or
Welcome!
https://example.com
Use your accounts.idp.com profile to sign into example.com and create an account with the information below:
Share my email
Sam Goto
Sign in with https://accounts.idp.com
continue
samuelgoto@gmail.com
Forward to:
samuelgoto@gmail.com
cancel
By signing-in to example.com with your email address, you can be tracked across sites.
samuelgoto@gmail.com
cancel
allow
Would you like to sign-in to example.com with accounts.idp.com?
No
Yes
#1 The Permission-oriented Variation
User Agent
Relying Party
your@email.com
******
IDP1
IDP2
Sign Up
or
Welcome!
https://example.com
forgot password
your@email.com
******
IDP1
IDP2
Sign Up!
or
Welcome!
https://example.com
Use your accounts.idp.com profile to sign into example.com and create an account with the information below:
samuelgoto@gmail.com
Share my email
NAME
Sam Goto
continue
samuelgoto@gmail.com
Forward to
cancel
#2 The Mediation-oriented Variation
IDP Tracking
Email Proxy�(proxy.com)
Relying Party�(rp.com)
User Agent
Identity Provider�(idp.com)
[1] \Want to Sign-in with IDP.com?
[2a] What accounts does this user have?
[8] Welcome abc@proxy.com!
[6a] Check no one else has claimed id:abc�[6b] Verify email address (if included in claim)
[6c] Here is a nonce and a certificate.
[7] I am abc@proxy.com and SHA256(alice@email.com, RP, nonce). Prove this to me later with SIGNED(SHA256(alice@email, abc@proxy, RP, nonce), private key)
global email
directed email
keypair
certificate
nonce
recovery token
Email Provider�(email.com)
[4a] Does RP have an account for SHA256(alice@email.com, R, rp.com)?
[9] Welcome abc@proxy.com!
[4b] No..
[6] Can I sign IdTokens for {id:abc, email:abc@proxy.com}?
[5] Forward abc@proxy.com to alice@email.com and hand me back a certificate?
[2b] Sign-in user is alice@email.com.
#3 The Delegation-oriented Variation
Logout
Welcome Sam!��We got your verified email on record!�
https://example.com
If the user grants access, the id token is passed back to the application:��{
"alg": "HS256",
"typ": "JWT"
}�{
"iss": "https://accounts.a.com",
"sub": "110169484474386276334",
"aud": "https://example.com",
"name": "Sam",
"given_name": "Sam",
"family_name": "G.",
"email": "242423asf390@email.example",
"email_verified": "true",
}�HMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
SECRET
)
Browser
RP
IDP
Server-Side Relying Party Backwards Compatibility
Looking Forward
Challenges
Engagement
This deck is shared publicly.