Improving the Usability and Security of OpenID Mike Jones Microsoft Federated Identity Team

What is OpenID? A Web Single-Sign-On (SSO) technology – Enables using account you have at one site to sign into others Originally designed for blog commenting – May become universal sign-on and sign-up system for Internet An OpenID is a URL referencing an account you control Example OpenIDs: – – – – – –

OpenID Flow OpenID Provider (OP) Web Site Relying Party (RP) Web Site 1. User visits RP site 2. User chooses an OpenID 3. RP redirects browser to OP 4. User signs into OP 5. OP redirects browser to RP 6. User signed into RP site with OpenID

Basic OpenID Demo Making a blog comment

“NASCAR” Experience Demo Clicking on logos instead of typing URLs

Phishing Demo Malicious site stealing my OpenID password

What have we seen so far? Basic OpenID UX requires remembering URLs – Doesn’t work for most people NASCAR experience easier, but only for providers with buttons – Doesn’t scale or facilitate choice Phishing easy to accomplish – And NASCAR logos actually make it worse

An Active Client for OpenID Remembers your identities – Instead of you having to remember URLs Brings your identities with you to the site – Instead of the site having to guess what they are Supervises identity interactions for you – Providing a defense against phishing sites

First Time Use Demo First time use of an Identity Selector (the active client) at an OpenID site – Plaxo one of sites we worked with on prototype – Site live on the Internet

Second Time Use Demo Second time use of an Identity Selector (the active client) at an OpenID site

Personal OpenID Usage Demo Using a personal OpenID, which is delegated to another OpenID Provider

Demo at Another Site Shows bringing my OpenIDs with me to site

What have we seen? Identity Selector improves usability of OpenID – Remembers my identities for me – Brings them with me to sites Identity Selector improves security of OpenID – Warns when using untrusted identity provider – Informs whether OpenIDs used at site before

Status and Future Work OpenID Identity Selector effort an incubation – No OpenID standards yet for active clients – Shown at OpenID Summit and Internet Identity Workshop (IIW) in November 2009 OpenID advocates considering active client specifications – Would go through OpenID standards process Part of OpenID v.Next work begun at IIW

For More Information See my blog – Especially on this workhttp://self-issued.info/?p=235 – And on the OpenID v.Next goalshttp://self-issued.info/?p=256 Contact me at