[slides.git] / fosdem2017 / index.html

<!DOCTYPE html>
<html>
<head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <meta name="Author" content="KaiRo - Robert Kaiser">
  <title>Web Logins after Persona</title>
  <link rel="stylesheet" type="text/css" href="slides.css">
  <script type="text/javascript" src="slides.js"></script>
  <link rel="contents" href="#index" title="Overview">
  <link rel="index" id="link-toc" href="#toc" title="Contents">
  <link rel="start" id="link-start" href="#index" title="Start">
</head>
<body onload="docLoaded();">
<header id="header"><div id="header-text">Web Logins</div>
  <div id="subheader-text"></div>
  <a id="headerlogo" href="#index" title="Startseite">Mozilla</a>
</header>
<nav id="slidenav">
  <a href="#toc" id="nav-toc" accesskey="t">toc</a> ||
  <a href="#index" id="nav-start" accesskey="s">start</a> ||
  <a href="#" id="nav-prev" accesskey="p" hidden>&lt; back</a>
  <span id="nav-prev-nolink" class="nolink">&lt; back</span> |
  <a href="#" id="nav-next" id="goNext" accesskey="n" hidden>fwd &gt;</a>
  <span id="nav-next-nolink" class="nolink">fwd &gt;</span>
</nav>

<article id="toc" title="Table of Contents">
<h1>Table of Contents</h1>
<h2>Web Logins after Persona</h2>

<div class="captionedbox">
<p class="captionedbox-caption">The following slides are available in this presentation:</p>
<div class="captionedbox-content">
<ul id="toc-list">
</ul>
</article>

<article id="index" title="Start Page">
<h1>Web Logins after Persona</h1>
<h2>How I solved logins on my small websites</h2>

<div class="simplebox">
<mark><a href="http://home.kairo.at/">Robert Kaiser</a></mark>,
"KaiRo" &lt;kairo@kairo.at&gt;
<br><small>Mozilla Rep</small>
</div>

<div class="captionedbox">
<p class="captionedbox-caption">Slides:
  <a href="https://slides.kairo.at/fosdem2016/">https://slides.kairo.at/fosdem2017/</a></p>
<div class="captionedbox-content small">
<ul class="small">
  <li>Created for
    <a href="http://fosdem.org/2016/schedule/track/mozilla/">Mozilla
    Developer Room</a> at <a href="http://www.fosdem.org/">FOSDEM 2017</a> in
    Brussels.</li>
  <li>Written in HTML 5 with CSS 3 and JavaScript.</li>
  <li>Navigation via links on all slides, via access keys
   (e.g. "n"/Alt+Shift+N for "next") or back/forward arrow keys</li>
  <li><a href="#toc">Contents</a></li>
  <li><a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/at/"><img
        alt="Licensed under CC-BY-SA," style="border-width:0;vertical-align:bottom;"
        src="cc-by-sa-80x15.png"></a> 01/2017 Robert Kaiser.</li>
</ul>
</div>
</div>
</article>

<article id="persona" title="What's Persona?">
<h1>What <s>is</s>was Persona?</h1>

<div class="simplebox">
<p>Login/Identity solution by Mozilla, 2011-2016</p>
<ul>
  <li>Decentralized / Federated (with Fallback)</li>
  <li>Multiple identities</li>
  <li>Verified Email</li>
  <li>Potential for browser integration</li>
  <li>BrowserID protocol, easy to implement, server-side verification</li>
  <li>Permission-less</li>
</ul>
<p><a href="http://feeding.cloud.geek.nz/posts/persona-guiding-principles/">See
blog post by François Marier</a></p>
</div>
</article>

<article id="smallsite" title="Needs of a Small Website">
<h1>Needs of a Small Website</h1>

<div class="simplebox">
<ul>
  <li>Easy to implement</li>
  <li>Trusted identification</li>
  <li>Avoid dealing with how to secure passwords</li>
  <li>No lock-in (identification via email?)</li>
  <li>Privacy (not telling every login attempt to a big company)</li>
</ul>
</div>
</article>

<article id="localext" title="Local vs. External Login">
<h1>Local vs. External Login</h1>

<div class="simplebox">
<ul>
  <li>Local: Need to secure passwords</li>
  <li>Local: Sounds easy to implement, complications in details</li>
  <li>Local: Can always be trusted</li>
  <li>External: Potential for lock-in</li>
  <li>External: Potential privacy issues</li>
  <li>External: Implementation difficulty depends on API</li>
</ul>
</div>
</article>

<article id="extalt" title="External Alternatives">
<h1>External Alternatives</h1>

<div class="simplebox">
<ul>
  <li><s>Mozilla Persona</s></li>
  <li><s>Firefox Accounts</s></li>
  <li>Facebook, Google, GitHub</li>
  <li>Other OAuth2 providers</li>
  <li>OpenID Connect (OIDC) providers (based on OAuth2)</li>
  <li>Other/older providers/standards (OAuth1, ...)</li>
  <li>Intermediates, e.g. Auth0</li>
</ul>
</div>
</article>

<article id="portier" title="Interlude: A Future Alternative">
<h1>Interlude: A Future Alternative</h1>

<div class="simplebox">
<p><a href="https://portier.github.io/">Portier</a> is a new in-development alternative</p>
<ul>
  <li>Email authentication</li>
  <li>Decentralized (fallback to passwordless email auth)</li>
  <li>Speaking OIDC to client and "Brokers"</li>
  <li>"Spiritual successor to Mozilla Persona"</li>
  <li>Still in development ("early beta")</li>
</ul>
</div>
</article>

<article id="selfhost" title="Self-Hosted &quot;External&quot;">
<h1>Self-Hosted &quot;External&quot;</h1>

<div class="simplebox">
<ul>
  <li>Full control over login stack</li>
  <li>Password security isolated from website code</li>
  <li>Management of multiple identities possible</li>
  <li>Privacy and trust are no issues</li>
  <li>When using standard API, possibility for being switched out later</li>
  <li>Still needing to secure properly</li>
</ul>
</div>
</article>

<article id="phpauthserver" title="The PHP Authserver">
<h1>The PHP Authserver</h1>

<div class="simplebox">
<ul>
  <li>OAuth2 API (potential extension to OIDC later), using <a href="http://bshaffer.github.io/oauth2-server-php-docs/">oauth2-server-php</a></li>
  <li>Password storage with password_hash (currently bcrypt) + nonce, auto-upgrade on login</li>
  <li>Relatively easy to install on Linux with Apache + PHP5/PHP7 + MySQL (Other DBs should be easy to support)</li>
  <li><a href="http://www.doctrine-project.org/projects/dbal.html">Doctrine DBAL</a> for DB abstraction,
      <a href="https://github.com/KaiRo-at/php-utility-classes">php-utility-classes</a> for email and DOM document abstraction</li>
  <li>Skinnable to brand installation to fit operator</a>
  <li>My installation at <a href="https://auth.kairo.at/">auth.kairo.at</a> scores <a href="https://observatory.mozilla.org/analyze.html?host=auth.kairo.at">A+ from Mozilla Observatory</a></li>
</ul>
</div>
</article>

<article id="status" title="Current Status">
<h1>Current Status</h1>
<ul>
  <li>Only Authorization Code flow supported right now, oauth2-server-php can do Client Credentials as well as OIDC, should not be too hard to add.</li>
  <li>Tested with Apache and MySQL for now, other web and DB servers should be possible easily.</li>
  <li>Rudimentary documentation exists in the main README.</li>
  <li>Languages supported are US English (default) and German, detected via Accept-Language sent by browser.</li>
  <li>Testing is done by running logins with KaiRo's websites (2 different client implementations).</li>
  <li><mark>Open Source at <a href="https://github.com/KaiRo-at/authserver">github.com/KaiRo-at/authserver</a></mark>, under MPL2 - <mark>released TODAY</mark>!</li>
</ul>
<div class="simplebox">

</div>
</article>

<article id="help" title="Help Needed">
<h1>Help Needed</h1>

<div class="simplebox">
<ul>
  <li>Implementation of OIDC and perhaps Client Credentials flows.</li>
  <li>Setting up a test suite and infrastructure.</li>
  <li>Writing more complete documentation.</li>
  <li>More languages?</li>
  <li>More installations?</li>
  <li>Your ideas and pull requests!</li>
</ul>
</div>
</article>

<article id="end" title="The End">

<div class="simplebox">
<h1 class="cent" style="position: relative; z-index: 3; font-size: 2.5em;">Questions?</h1>
<h2 class="cent" style="position: relative; margin-top: 3rem; z-index: 3; font-size: 2em;"><a href="https://github.com/KaiRo-at/authserver">github.com/KaiRo-at/authserver</a></h2>
<img src="autodestruct_deactivated.jpg" class="sshot"
     style="width: 100%; margin-top: -7.5em; position: relative; z-index: 1;"
     alt="Auto Destruct Deactivated">
</div>
</article>

</body>
</html>
Commit	Line	Data
df2f979f RK	1	<!DOCTYPE html>
	2	<html>
	3	<head>
	4	<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
	5	<meta name="Author" content="KaiRo - Robert Kaiser">
	6	<title>Web Logins after Persona</title>
	7	<link rel="stylesheet" type="text/css" href="slides.css">
	8	<script type="text/javascript" src="slides.js"></script>
	9	<link rel="contents" href="#index" title="Overview">
	10	<link rel="index" id="link-toc" href="#toc" title="Contents">
	11	<link rel="start" id="link-start" href="#index" title="Start">
	12	</head>
	13	<body onload="docLoaded();">
	14	<header id="header"><div id="header-text">Web Logins</div>
	15	<div id="subheader-text"></div>
	16	<a id="headerlogo" href="#index" title="Startseite">Mozilla</a>
	17	</header>
	18	<nav id="slidenav">
	19	<a href="#toc" id="nav-toc" accesskey="t">toc</a> \|\|
	20	<a href="#index" id="nav-start" accesskey="s">start</a> \|\|
	21	<a href="#" id="nav-prev" accesskey="p" hidden>< back</a>
	22	<span id="nav-prev-nolink" class="nolink">< back</span> \|
	23	<a href="#" id="nav-next" id="goNext" accesskey="n" hidden>fwd ></a>
	24	<span id="nav-next-nolink" class="nolink">fwd ></span>
	25	</nav>
	26
	27	<article id="toc" title="Table of Contents">
	28	<h1>Table of Contents</h1>
	29	<h2>Web Logins after Persona</h2>
	30
	31	<div class="captionedbox">
	32	<p class="captionedbox-caption">The following slides are available in this presentation:</p>
	33	<div class="captionedbox-content">
	34	<ul id="toc-list">
	35	</ul>
	36	</article>
	37
	38	<article id="index" title="Start Page">
	39	<h1>Web Logins after Persona</h1>
	40	<h2>How I solved logins on my small websites</h2>
	41
	42	<div class="simplebox">
	43	<mark><a href="http://home.kairo.at/">Robert Kaiser</a></mark>,
	44	"KaiRo" <kairo@kairo.at>
	45	<br><small>Mozilla Rep</small>
	46	</div>
	47
	48	<div class="captionedbox">
	49	<p class="captionedbox-caption">Slides:
	50	<a href="https://slides.kairo.at/fosdem2016/">https://slides.kairo.at/fosdem2017/</a></p>
	51	<div class="captionedbox-content small">
	52	<ul class="small">
	53	<li>Created for
	54	<a href="http://fosdem.org/2016/schedule/track/mozilla/">Mozilla
	55	Developer Room</a> at <a href="http://www.fosdem.org/">FOSDEM 2017</a> in
	56	Brussels.</li>
	57	<li>Written in HTML 5 with CSS 3 and JavaScript.</li>
	58	<li>Navigation via links on all slides, via access keys
	59	(e.g. "n"/Alt+Shift+N for "next") or back/forward arrow keys</li>
	60	<li><a href="#toc">Contents</a></li>
	61	<li><a rel="license" href="http://creativecommons.org/licenses/by-sa/3.0/at/"><img
	62	alt="Licensed under CC-BY-SA," style="border-width:0;vertical-align:bottom;"
	63	src="cc-by-sa-80x15.png"></a> 01/2017 Robert Kaiser.</li>
	64	</ul>
65	</div>
66	</div>
67	</article>
68
69	<article id="persona" title="What's Persona?">
70	<h1>What <s>is</s>was Persona?</h1>
71
72	<div class="simplebox">
73	<p>Login/Identity solution by Mozilla, 2011-2016</p>
74	<ul>
75	<li>Decentralized / Federated (with Fallback)</li>
76	<li>Multiple identities</li>
77	<li>Verified Email</li>
78	<li>Potential for browser integration</li>
79	<li>BrowserID protocol, easy to implement, server-side verification</li>
80	<li>Permission-less</li>
81	</ul>
82	<p><a href="http://feeding.cloud.geek.nz/posts/persona-guiding-principles/">See
83	blog post by François Marier</a></p>
84	</div>
85	</article>
86
87	<article id="smallsite" title="Needs of a Small Website">
88	<h1>Needs of a Small Website</h1>
89
90	<div class="simplebox">
91	<ul>
92	<li>Easy to implement</li>
93	<li>Trusted identification</li>
94	<li>Avoid dealing with how to secure passwords</li>
95	<li>No lock-in (identification via email?)</li>
96	<li>Privacy (not telling every login attempt to a big company)</li>
97	</ul>
98	</div>
99	</article>
100
101	<article id="localext" title="Local vs. External Login">
102	<h1>Local vs. External Login</h1>
103
104	<div class="simplebox">
105	<ul>
106	<li>Local: Need to secure passwords</li>
107	<li>Local: Sounds easy to implement, complications in details</li>
108	<li>Local: Can always be trusted</li>
109	<li>External: Potential for lock-in</li>
110	<li>External: Potential privacy issues</li>
111	<li>External: Implementation difficulty depends on API</li>
112	</ul>
113	</div>
114	</article>
115
116	<article id="extalt" title="External Alternatives">
117	<h1>External Alternatives</h1>
118
119	<div class="simplebox">
120	<ul>
121	<li><s>Mozilla Persona</s></li>
122	<li><s>Firefox Accounts</s></li>
123	<li>Facebook, Google, GitHub</li>
124	<li>Other OAuth2 providers</li>
125	<li>OpenID Connect (OIDC) providers (based on OAuth2)</li>
126	<li>Other/older providers/standards (OAuth1, ...)</li>
127	<li>Intermediates, e.g. Auth0</li>
128	</ul>
129	</div>
130	</article>
131
132	<article id="portier" title="Interlude: A Future Alternative">
133	<h1>Interlude: A Future Alternative</h1>
134
135	<div class="simplebox">
136	<p><a href="https://portier.github.io/">Portier</a> is a new in-development alternative</p>
137	<ul>
138	<li>Email authentication</li>
139	<li>Decentralized (fallback to passwordless email auth)</li>
140	<li>Speaking OIDC to client and "Brokers"</li>
141	<li>"Spiritual successor to Mozilla Persona"</li>
142	<li>Still in development ("early beta")</li>
143	</ul>
144	</div>
145	</article>
146
147	<article id="selfhost" title="Self-Hosted "External"">
148	<h1>Self-Hosted "External"</h1>
149
150	<div class="simplebox">
151	<ul>
152	<li>Full control over login stack</li>
153	<li>Password security isolated from website code</li>
154	<li>Management of multiple identities possible</li>
155	<li>Privacy and trust are no issues</li>
156	<li>When using standard API, possibility for being switched out later</li>
157	<li>Still needing to secure properly</li>
158	</ul>
159	</div>
160	</article>
161
162	<article id="phpauthserver" title="The PHP Authserver">
163	<h1>The PHP Authserver</h1>
164
165	<div class="simplebox">
166	<ul>
167	<li>OAuth2 API (potential extension to OIDC later), using <a href="http://bshaffer.github.io/oauth2-server-php-docs/">oauth2-server-php</a></li>
168	<li>Password storage with password_hash (currently bcrypt) + nonce, auto-upgrade on login</li>
169	<li>Relatively easy to install on Linux with Apache + PHP5/PHP7 + MySQL (Other DBs should be easy to support)</li>
170	<li><a href="http://www.doctrine-project.org/projects/dbal.html">Doctrine DBAL</a> for DB abstraction,
171	<a href="https://github.com/KaiRo-at/php-utility-classes">php-utility-classes</a> for email and DOM document abstraction</li>
172	<li>Skinnable to brand installation to fit operator</a>
173	<li>My installation at <a href="https://auth.kairo.at/">auth.kairo.at</a> scores <a href="https://observatory.mozilla.org/analyze.html?host=auth.kairo.at">A+ from Mozilla Observatory</a></li>
174	</ul>
175	</div>
176	</article>
177
178	<article id="status" title="Current Status">
179	<h1>Current Status</h1>
180	<ul>
181	<li>Only Authorization Code flow supported right now, oauth2-server-php can do Client Credentials as well as OIDC, should not be too hard to add.</li>
182	<li>Tested with Apache and MySQL for now, other web and DB servers should be possible easily.</li>
183	<li>Rudimentary documentation exists in the main README.</li>
184	<li>Languages supported are US English (default) and German, detected via Accept-Language sent by browser.</li>
185	<li>Testing is done by running logins with KaiRo's websites (2 different client implementations).</li>
186	<li><mark>Open Source at <a href="https://github.com/KaiRo-at/authserver">github.com/KaiRo-at/authserver</a></mark>, under MPL2 - <mark>released TODAY</mark>!</li>
187	</ul>
188	<div class="simplebox">
189
190	</div>
191	</article>
192
193	<article id="help" title="Help Needed">
194	<h1>Help Needed</h1>
195
196	<div class="simplebox">
197	<ul>
198	<li>Implementation of OIDC and perhaps Client Credentials flows.</li>
199	<li>Setting up a test suite and infrastructure.</li>
200	<li>Writing more complete documentation.</li>
201	<li>More languages?</li>
202	<li>More installations?</li>
203	<li>Your ideas and pull requests!</li>
204	</ul>
205	</div>
206	</article>
207
208	<article id="end" title="The End">
209
210	<div class="simplebox">
211	<h1 class="cent" style="position: relative; z-index: 3; font-size: 2.5em;">Questions?</h1>
212	<h2 class="cent" style="position: relative; margin-top: 3rem; z-index: 3; font-size: 2em;"><a href="https://github.com/KaiRo-at/authserver">github.com/KaiRo-at/authserver</a></h2>
213	<img src="autodestruct_deactivated.jpg" class="sshot"
214	style="width: 100%; margin-top: -7.5em; position: relative; z-index: 1;"
215	alt="Auto Destruct Deactivated">
216	</div>
217	</article>
218
219	</body>
220	</html>