1. ‘Lord’ was a click away from £229m “They installed software on the company computers allowing them to steal [Sumitomo bank] staff user names and passwords”

2. Security vs Usability Too many web sites, so –Weak, memorable passwords –Single passwords across multiple sites –Undervalued accounts

3. SECURITY Site THREAT

4. Record high Phishing levels Source: Anti Phishing Working Group (non-profit run by David Jevans - IronKey CEO)

5. Threat Landscape Includes Keyloggers XSS vulnerabilities on shared hosting Nefarious sys admins Web application security scanners Your digital identity can be under attack –24 x 7 x 365

6. What is OpenID? An open source standard for a free & easy to use digital identity across multiple sites It is a protocol that OpenID compliant web sites use to talk to OpenID providers Used by Symantec, Microsoft, AOL, Verisign, Sun, IBM, Yahoo, Google, facebook, the entire population of Estonia

7. OpenID Libraries

8. OpenID Demo https://pip.verisignlabs.com/

9. What about Drupal OpenID authentication support –D5 via contrib –D6 in core –D7 in core, planned with Oauth OpenID provider –6.x-1.x-dev by walkah Drupalcon DC OpenID code Sprint

10. SECURITY Site Provider Site THREAT

11. Swekey Demo You can try http://blog.to.ithttp://blog.to.it

12. Site Provider Site ? SECURITY THREAT Multifactor authentication

13. OpenID benefits Reduces site registration barrier Reduces account management overhead Increases usability and security Reduces trust required of site admins (multiply by number of accounts) Barriers?

14. So What?

15. Resources Anti Phishing Working Group (APWG) –http://www.antiphishing.orghttp://www.antiphishing.org OpenID –http://openid.nethttp://openid.net –http://wiki.openid.net/Librarieshttp://wiki.openid.net/Libraries –http://openiddirectory.comhttp://openiddirectory.com Drupal OpenID Provider module (Walkah) –http://drupal.org/project/openid_providerhttp://drupal.org/project/openid_provider Swekey –http://drupal.org/project/swekeyhttp://drupal.org/project/swekey –http://www.swekey.com/http://www.swekey.com/ Walkah’s dc2009 talk –http://dc2009.drupalcon.org/session/openid-drupal-and-open-webhttp://dc2009.drupalcon.org/session/openid-drupal-and-open-web –http://www.archive.org/details/DrupalconDc2009-OpenidDrupalAndTheOpenWebhttp://www.archive.org/details/DrupalconDc2009-OpenidDrupalAndTheOpenWeb Chris Messina, Lullabot discuss OpenID, opennes, identity –http://www.lullabot.com/audiocast/podcast-71-chris-messina-and-open-identityhttp://www.lullabot.com/audiocast/podcast-71-chris-messina-and-open-identity