The Security Roundtable

Jump to Comments

We’re back! Dan York, Martin McKeay and Michael Santarcangelo came together to revitalize the SRT effort and concept. First up - Dan York led an effort to research and put together a program on OpenID. In this episode, we explore the question, “what is open ID and should we care?”- Dan York, Blue Box: The VoIP Security Podcast- Martin McKey: The Network Security Podcast- Michael Santarcangelo: The Security CatalystThese show notes are going to be swamped with links and information about OpenID. A HUGE thank you to Dan York for an amazing effort, here. This is actually the single best collection of OpenID links I’ve yet to see.If you feel like discussing OpenID (or looking to find some positive and passionate security professionals), come discuss this in the Security Catalyst Community: http://community.securitycatalyst.com/forums/index.phpHere is the OpenID thread: http://community.securitycatalyst.com/forums/index.php/topic,46.0.htmlNOTE - found another recent (Dec 2006) podcast about OpenID:- blog entry - http://herestomwiththeweather.blogspot.com/2006/12/openid-podcast.html (interesting notes about moving a site over to OpenID)- MP3 - http://www.stuffopolis.com/interactive/openid.mp3- Outline - http://www.stuffopolis.com/interactive/openid_talk.txt

---

Main focus of the show - what is OpenID and why should you care? 

Why is OpenID in the news right now?

Microsoft Announcement at RSA generated news - announced by Bill Gates in keynote:

• Microsoft view: http://www.identityblog.com/?p=668
• JainRain view: http://kveton.com/blog/2007/02/06/cardspace-openid-working-together/
• Sxip Identity: http://identity20.com/?p=90
• Netmesh: http://netmesh.info/jernst/Digital_Identity/cardspace-openid.html
• Brad Fitzpatrick (who wrote OpenID back at LiveJournal): http://brad.livejournal.com/2287909.html
• - see the TailRank summary for follow-on commentary
• Digg adopts OpenID: http://www.techcrunch.com/2007/02/20/kevin-rose-at-fowa-digg-adopts-openid

• Slashdot discussion - good comments: http://yro.slashdot.org/comments.pl?threshold=0&mode=thread&commentsort=0&op=Change&sid=221002

Excellent summary - “Five Key Takeaways from Microsoft, OpenID Announcement“Other recent news - AOL support OpenID: http://journals.aol.com/panzerjohn/abstractioneer/entries/2007/02/15/aol-and-openid-where-we-are/1406It also appears that AOL enabled OpenID support for all 63 million AIM users! - http://chimprawk.blogspot.com/2007/02/is.html

What is OpenID? What problem is it trying to solve?

Main OpenID website - http://www.openid.net/Wikipedia - http://en.wikipedia.org/wiki/OpenIDCommunity marketing - http://iwantmyopenid.org/illustrated overviews:

• OpenID 1.1 protocol flow - http://openid.net/pres/protocolflow-1.1.png
• http://www.openidenabled.com/openid/openid-protocol
• OpenID pingpong - http://enthusiasm.cozy.org/archives/2005/05/openid-part-iii-pingpong/

• Screencast - http://simonwillison.net/2006/openid-screencast/
• Presentation - http://identity20.com/media/ETECH_2006/ - great history of web identity systems - gets into company-specific stuff at the end, but does a nice overall job.

OpenID specification- http://openid.net/specs.bmlZDNet: “The Case for OpenID” - http://blogs.zdnet.com/digitalID/?p=78

How does it work?

See http://openid.net/about.bmlList of presentations at http://openid.net/presentations.bmlOpenID screencast - http://simonwillison.net/2006/openid-screencast/From http://www.openidenabled.com/openid/about-openidGood description of process (from Microsoft’s Kim Cameron ): An interaction starts with the user telling the RP (relying party) what her URL is (1). The RP consults the URL content to determine where the user’s IP is located (not shown). Then it redirects the user to her IP (identity provider) to pick up an authentication token, as shown in (2) and (3). To do the authentication, the IP has to be sure that it’s the user who is making the request. So it presents her with an authentication screen, typically asking for a username and password in (4). If they are entered correctly, the IP mints a token to send to the RP as shown in (5) and (6). If the IP and RP already know each other, this is the end of the authentication part of the protocol. If not, the back channel is used as well.More details:

• You register with a Identity provider (IdP or “i-broker”). Some are commercial, some are free. Examples:

• ClaimID: http://www.claimid.com/
• MyOpenID (JainRain): http://www.myopenid.com/
• Verisign: http://pip.verisignlabs.com/
• LiveJournal - your LiveJournal account can be used as an OpenID.
• Long list of public OpenID providers - http://openid.net/wiki/index.php/Public_OpenID_providers

You can also set up your own OpenID server/service

Note that you can use your own URL with an OpenID service: http://www.openidenabled.com/openid/use-your-own-url-as-an-openid

When you now go to a website, you can login with your OpenID. Sites that can use OpenID:

• OpenID Site Directory: https://www.myopenid.com/directory
• OpenIDEnabled Site: http://www.openidenabled.com/
• Technorati: http://technorati.com/weblog/2006/10/144.html
• Mag.nolia: http://ma.gnolia.com/blog/2006/11/30/sign-in-your-way

You are required to then login to your OpenID provider’s site (if you have not already done so)

You are logged into the site

So for a blog comment, for instance, instead of typing in your username, password, etc., you could just use your OpenID.More sites will be using it soon… note the bounty for OpenID in open source projects: http://iwantmyopenid.org/bounty

Security issues - phishing

• Critical part is where you login to your IdP… what if a phisher set up a site to dupe your OpenID provider? They could then capture your credentials
• Description of threat (and Microsoft response): http://www.identityblog.com/?p=659
• Ideas to respond: http://kveton.com/blog/2007/01/24/myopenid-new-anti-phishing-tools-available/
• Another idea (and MITM attack): http://usablesecurity.com/2007/01/20/phishing-and-openid/
• Aswath Rao: http://www.mocaedu.com/mt/archives/000287.html

Open option for Firefox: PHOff - http://chile.ootao.com/phoff/Other commentary on the phishing issue:

• http://www.links.org/?p=187 and http://www.links.org/?p=188
• “OpenID, before you get too excited” - http://www.clipperz.com/users/marco/blog/2007/01/26/openid_before_you_get_too_excited

Security issues - single point-of-failure

• So what happens if your Identity provider goes away? Or you decide you want to stop trusting them?
• Two solutions:
  1. Have multiple OpenIDs - no reason you can’t.
  2. Use a domain that you own as your OpenID and delegate back to a IdP - just by adding two lines of HTML code to that website - see http://simonwillison.net/2006/Dec/19/openid/
• This second solution is probably best because you retain control. In first solution, what happens to all those accounts you created with the ID that you no longer trust.

Future of OpenID

• Steve Kveton’s predictions - http://kveton.com/blog/2007/01/04/2007-openid-predictions/
• OpenID 2.0 specification? - http://openid.net/specs/openid-authentication-2_0-11.html
• Further adoption - AOL’s plans. Yahoo? Google? (will it work with those accounts?)
• CardSpace and other complementary products
• OpenID as an authentication mechanism in VoIP? - http://www.mocaedu.com/mt/archives/000285.html
• OpenID as a way to maintain control over blog content? - http://www.micropersuasion.com/2007/01/blog_platforms_.html (I don’t know that this will actually work, as I learn more about OpenID)

• Competing systems? SAML from Liberty Alliance? Proprietary? Typekey ? (although see the SixApart page on OpenID)

Links for more research:

Dan’s del.icio.us links - http://del.icio.us/dyork/openidPlanet OpenID (splice of blogs) - http://planet.openid.net/OpenID Wiki - http://openid.net/wiki/index.php/Main_PageMore del.icio.us links - http://del.icio.us/keepthebyte/openid and http://del.icio.us/tag/openidConverting your site to OpenID: http://kveton.com/blog/2006/11/28/converting-your-site-to-openid/emphemeral profiles - do some people really want identity anyway? http://www.zephoria.org/thoughts/archives/2007/01/01/ephemeral_profi.html and http://vquill.com/2007/01/throwaway-identities.htmlKim Cameron’s lengthy paper on digital identity - see the “Laws of Identity” section: http://www.identityblog.com/?page_id=352/