Transcript Open_Id
By: Ansuya Chauhan What is Open ID??? • Single Sign-on System • Simple to use • Uses proven technologies like DNS, HTTP, • SSL/TLS and Diffie-Hellman • It’s Decentralized • It’s Free History • • • • 2005 The original OpenID authentication protocol was developed in May 2005 by Brad Fitzpatrick, creator of popular community website LiveJournal, while working at Six Apart. 2006 In March 2006, JanRain developed a Simple Registration Extension for OpenID for primitive profile-exchange, and in April submitted a proposal to formalize extensions to OpenID. 2007 On January 31, 2007, computer security company announced support for OpenID in its Identity Initiative products and services. 2008 In mid-January 2008, Yahoo announced initial OpenID 2.0 support, both as a provider and as a relying party, releasing the service by the end of the month. In early February, Google, IBM, Microsoft, VeriSign, and Yahoo! joined the OpenID Foundation as corporate board members. Three Party System Why OpenID? • • • • • Too many Usernames and Passwords Someone took your desired Username User profile is distributed Account management is difficult Get bored of filling long forms again and again With OpenId, you get to choose who manages your identity An OpenId is a URL • URL are Globally unique. • OpenId allows proving ownership of an URL • People already have identity at URLS via blogs, photos, Myspace and Facebook Etc Communication Modes Direct Communication Indirect Communication Modes of Communication There are two basic methods or modes of communication between the consumer and the identity provider depending upon how consumer is configured. • Dumb Mode • Smart Mode How OpenID works?? How openId works? • • • • Site Fetches the HTML of my openID Finds “ openid.server” Establishes a shared secret with the provider Redirects my browser to the provider where I authenticate and allow the openId login • Provider redirects my browser back to the site with an openId response. • Site verifies the signature and logs me in How to Use OpenId? • http://www.youtube.com/watch?v=Vq0R1Y1A2rE Types of Messages • Four basic types of messages • The associate message • The check_immediate message • The check_setup message The check_authentication message Protocols and Security • Authentication Uses URL as the Identity of User • OpenID 2.0 uses Yadis. • Uses Diffie-Hellman Key Exchange Mechanism at different level. • Use Secured Socket Layer • Generate strong MAC keys. OpenID Support in different Languages • OpenID Is supported in many programming languages and API’s are available • Java, PHP, Perl C/C++, C##, python ,cold Fusion Limitation of OpenID & Possible Solutions. • Phishing • A distrusted site redirects you to your trusted provider through a proxy. Possible Solutions • Trusted and Security features by OpenID provider • Jabber • Microsoft card space • DynDNS Advantages • Globally unique & your URL is your Identity • Few usernames and passwords to remember • Many OpenID provider like AOL, yahoo,verisignlabs, myOpenID • Can put OpenID URL on your server also • Profile data are stored at one place only. • Control of sharing information. • Can easily increase business Future & Conclusion • Future • Email as OpenID • Banking and E-commerce with strong authentication • Zero sign on • High level security algorithm Conclusion OpenID as future web authentication References • • • • • http://en.wikipedia.org/wiki/OpenID#History http://www.livejournal.com/openid/ http://openid.net/ http://wiki.openid.net/OpenID_HTTP_Authentication http://openidtrustbearer.wordpress.com/ • http://video.google.com/videoplay?docid=2288395847791059857