1. Improving the Usability and Security of OpenID Mike Jones Microsoft Federated Identity Team mbj@microsoft.com

2. What is OpenID? A Web Single-Sign-On (SSO) technology – Enables using account you have at one site to sign into others Originally designed for blog commenting – May become universal sign-on and sign-up system for Internet An OpenID is a URL referencing an account you control Example OpenIDs: – http://self-issued.info/ – https://mbj.signon.com/ – http://mbj.pip.verisignlabs.com/ – http://self-issued.myopenid.com/ – http://yahoo.com/ – https://www.google.com/accounts/o8/id

3. OpenID Flow OpenID Provider (OP) Web Site Relying Party (RP) Web Site 1. User visits RP site 2. User chooses an OpenID 3. RP redirects browser to OP 4. User signs into OP 5. OP redirects browser to RP 6. User signed into RP site with OpenID

4. Basic OpenID Demo Making a blog comment

5. “NASCAR” Experience Demo Clicking on logos instead of typing URLs

6. Phishing Demo Malicious site stealing my OpenID password

7. What have we seen so far? Basic OpenID UX requires remembering URLs – Doesn’t work for most people NASCAR experience easier, but only for providers with buttons – Doesn’t scale or facilitate choice Phishing easy to accomplish – And NASCAR logos actually make it worse

8. An Active Client for OpenID Remembers your identities – Instead of you having to remember URLs Brings your identities with you to the site – Instead of the site having to guess what they are Supervises identity interactions for you – Providing a defense against phishing sites

9. First Time Use Demo First time use of an Identity Selector (the active client) at an OpenID site – Plaxo one of sites we worked with on prototype – Site live on the Internet

10. Second Time Use Demo Second time use of an Identity Selector (the active client) at an OpenID site

11. Personal OpenID Usage Demo Using a personal OpenID, which is delegated to another OpenID Provider

12. Demo at Another Site Shows bringing my OpenIDs with me to site

13. What have we seen? Identity Selector improves usability of OpenID – Remembers my identities for me – Brings them with me to sites Identity Selector improves security of OpenID – Warns when using untrusted identity provider – Informs whether OpenIDs used at site before

14. Status and Future Work OpenID Identity Selector effort an incubation – No OpenID standards yet for active clients – Shown at OpenID Summit and Internet Identity Workshop (IIW) in November 2009 OpenID advocates considering active client specifications – Would go through OpenID standards process Part of OpenID v.Next work begun at IIW

15. For More Information See my blog http://self-issued.info/http://self-issued.info/ – Especially http://self-issued.info/?p=235 on this workhttp://self-issued.info/?p=235 – And http://self-issued.info/?p=256 on the OpenID v.Next goalshttp://self-issued.info/?p=256 Contact me at mbj@microsoft.commbj@microsoft.com