I remember reading a tweet recently from someone about how the internet was evolving from standalone websites that function independently from each other, and towards a collection of service and content providers interlinked through shared APIs and XML. It’s already possible to see it in action in various locations across the web – the popular website Mashable contains a good amount of coverage on how new products are emerging that are powered by these new services.
One particular emerging service is open authentication. Groups such as the OpenID Foundation have emerged in order to promote a common set of standards for developers to use, while several decentralised OpenID providers have sprung up. In essence it all sounds like a good thing, with a site visitor benefiting by being able to use an existing username and password combination. The developer also wins by only having to use a set of freely available modules in order to support authentication instead of designing it themselves from scratch. Everything sounds perfect, right?
As you’ve probably guessed, there is a fly in the ointment. That fly is the relentless barrage of security nightmares that we face every time we switch our computer on and connect with the outside world. Everything from phishers to keyloggers are out there to try and find a chink in our virtual armour or our achilles heel. All of them lie in wait, hoping for a whiff of a password or a hint of a credit card number that they can then trade in underground markets. Don’t think that videogames are immune from this as well – indications are that credentials for World of Warcraft accounts can sell for up to twice as much as a set of credit card details.
Of course, the next step is to look at where your open authentication might be used. A collection of social networking sites might not be that big a deal – both Facebook and Twitter are setting themselves up as identity providers. At the moment, all that you’d be likely to lose is your reputation if someone managed to gain access to your Twitter account, particularly if you have a large number of followers. If it becomes possible to access your web-based email through the same service then suddenly all the other websites you use with a “forgotten your password?” function suddenly become vulnerable as well. This might expose things like names and addresses of friends and family members, which other online communities you visit and how you access them, and so on.
Paranoid yet? Potentially you should be, but that doesn’t mean that a solution can’t be implemented. Two-factor authentication has been kicking around for years, with reliance on something you know (a password) combined with something you have (a fingerprint, a retina scan or a key-ring with a digital display that changes every minute) in order to get around keyloggers and phishers sniffing your credentials out of the ether. Trouble is, fingerprint and retinal scanners are expensive, while it’s difficult to make a case for sending out tokens and dongles when a firm is effectively supplying a free service to customers.
There is another option. With the mobile phone becoming an increasing necessity in our lives, it’s becoming safer to assume that anyone using popular online services has one. As a result a number of free apps have emerged in order to support two-factor authentication, most notably from Blizzard Entertainment and Verisign. With these, the only cost is in developing the app itself before uploading it to the handset supplier app stores.
Twitter has also been moving towards OAuth as a way for granting applications access to a user’s account. The trouble with such techniques though is that they still fall back on the standard username and password, except that the user is logging in to Twitter directly instead of the website requesting access. It also grants access permanently until removed, meaning that the third party now has continual access to your details instead of the time required to support the transaction. For occasions where regular access is not required, the use of OAuth tokens is not suitable. That doesn’t mean that OAuth should be scrapped entirely – for apps that regularly need access to our individual identity data, a periodic refresh mechanism is fine. Sitting it alongside a solution that works for those one-off moments, or even to approve regular-access apps/OAuth tokens, would be a good move.
But why bother going to all this expense? At the end of the day, it’s about two things: the damage that someone misusing your credentials can cause, and the amount of time it’ll take to fix them again. Having to fix either of them is unappealing, yet whenever we use open authentication we run the risk of this happening. It’s crucial that this problem is addressed as part of the move towards identification services in order to maintain confidence in the social networking infrastructure as it moves to support them. Without it, all it takes is a couple of large scale compromising incidents for growth in the medium to stall.
As always, comments are welcome. If I’m wide of the mark or spot on, feel free to add your thoughts.







