% web-murk.tex -- Slides for web authentication murky tangle.
% $Id$
%
% Written by Russ Allbery <rra@stanford.edu>

\documentclass[landscape,semhelv]{seminar}
\usepackage{url}
\usepackage{hyperref}

\newpagestyle{mypagestyle}%
  {Stanford University \hfil \thedate \hfil \thepage}%
  {\hfil Russ Allbery (rra@stanford.edu) \hfil}
\pagestyle{mypagestyle}

\begin{document}

\begin{slide}
  \begin{center}
    {\huge The Murky Tangle of Web Authentication}

    \vspace{1in}
    
    Russ Allbery \\
    June 2, 2011
  \end{center}
\end{slide}

\begin{slide}
  \begin{center}
    You finished site-wide web authentication \\
    People can use one login for multiple sites \\
    You're now running a web authentication service

    \vspace{1in}

    {\huge Now what?}
  \end{center}
\end{slide}

\begin{slide}
  \begin{center}
    {\huge Password Fail}

    \vspace{0.5in}

    Users give their passwords to anyone who asks \\
    Legal business, salaries, health care done on the web \\
    Regulatory requirements are growing \\
    People can't remember good enough passwords

    \vspace{0.5in}

    {\huge Solution: Multifactor}
  \end{center}
\end{slide}

\begin{slide}
  \begin{center}
    {\huge What Multifactor Method?}
  \end{center}
\end{slide}

\begin{slide}
  \section*{Smart Cards}

  \begin{itemize}
  \item X.509 plus PIN is well-understood and fairly secure
  \item Integrates well with Kerberos
  \item PIV is a standard... sort of
  \item It works on Linux... sort of
  \item Provisioning systems are available... sort of
  \item Expensive
  \item Awkward (need readers, what about phones, ...)
  \item For 50,000 people, REALLY EXPENSIVE
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{SecurID}

  \begin{itemize}
  \item Proven (?) track record
  \item Hardware devices or smart phone applications
  \item If eBay and World of Warcraft can do it, why not us?
  \item Looks less and less appealing the deeper you look
  \item Expensive (surprisingly) and proprietary
  \item Pay RSA for random numbers?
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{OATH}

  \begin{itemize}
  \item Google solved your problem for you
  \item Standardized IETF OTP protocol (with good libraries!)
  \item Already available on most mobile platforms (except Blackberry)
  \item Nearly everyone already has a phone
  \item You can print them if you have to (Luddites supported)
  \item No Kerberos integration... yet
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{Stanford's Approach}

  \begin{itemize}
  \item Choose: Smart phone, SMS, printed list
  \item SMS is cents per message
  \item Expose factors used via web authentication protocol
  \item Expose LoA via web authentication protocol
  \item Central WebLogin server handles (complex!) user interaction
  \item Web only (for now), but web-only solves 90\% of problem
  \item Is the phone a good enough second factor?
  \item ``Weak'' multifactor, with ``strong'' multifactor coming
  \end{itemize}
\end{slide}

\begin{slide}
  \begin{center}
    {\huge Not ready for multifactor always...}
  \end{center}
\end{slide}

\begin{slide}
  \section*{Abused Accounts}

  \begin{itemize}
  \item Huge, HUGE increase in spear phishing
  \item Mostly used for spam (but no guarantees)
  \item Attackers willing to do extensive work to duplicate your login
    screens and automate attacks on your systems
  \item User education and filtering are insufficient
  \item Constantly closing the barn door after the horses
  \end{itemize}
\end{slide}

\begin{slide}
  \begin{center}
    {\huge Horse Watcher}

    \vspace{1in}

    Advance warning: Creepy, scary techniques to use to stalk your users
  \end{center}
\end{slide}

\begin{slide}
  \section*{Faster Than Sound}

  \begin{itemize}
  \item Feed all authentication events into one system with time, IP
  \item Look up the IP in a GeoIP database
  \item Is the user moving faster than the speed of sound?
  \item Is the user out of the expected countries?
  \item How many places are they coming from?
  \item False positives?  Oh, my, yes.  But too many?  Maybe not.
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{Abuse Plus Multifactor}

  \begin{itemize}
  \item Tell the user about strange logins
  \item Require multifactor for suspicious logins
  \item Encourage users to set up multifactor
  \item Similar to techniques used by financial institutions
  \item Side bonus (for schools): Finding lost students in emergencies
  \end{itemize}
\end{slide}

\begin{slide}
  \begin{center}
    {\huge Terrifying Privacy Issues}

    \vspace{0.5in}

    Do you want to have this data at all? \\
    Do you have a policy about how you're going to use it? \\
    Can you keep small the number of people who can see it? \\
    Others are already doing this... food for thought.
  \end{center}
\end{slide}

\begin{slide}
  \begin{center}
    {\huge Other things to think about...}
  \end{center}
\end{slide}

\begin{slide}
  \section*{Federation}

  \begin{itemize}
  \item SAML won
  \item You'll end up running Shibboleth and/or ADFS
  \item Authentication parts not particularly difficult
  \item Data release is a complicated and tricky mess
  \item Document standards as early as possible
  \item Invest in audit and management tools as early as possible
  \end{itemize}
\end{slide}

\begin{slide}
  \section*{Mobile and Web Services}

  \begin{itemize}
  \item Growth of web services with mobile client
  \item Central web authentication systems play poorly with programs
  \item Browsers and web services need different interfaces
  \item Solution: REST version of central login server
  \item Still has weird bits around the edges
  \item Kerberos on mobile plus better auth stacking would be nice
  \item Hard problem
  \end{itemize}
\end{slide}

\end{document}
