next presentation is why and users
choose identity providers all the way hi
I'm Kevin
and work at orange and in Harran we
delighted to be here so I will present
OCD on oz and relate to the data on
identity provider used on the web and
the idea is to find a why you you can't
choose the identity provider you trust
on the web so tooth of the the problem
statement then a presentational for CD
and all solution one a part of the
solution so like like explain the
yesterday in WebRTC the signaling goes
through a signaling server and the the
signaling server can set up a
man-in-the-middle attack so to solve
that WebRTC propose to use an identity
providers in the signaling loop to
resolve the issue of untrusted service
the idea is to add an identity assertion
in the session description protocol
offers that will assert the the
fingerprint of the user so they can be
both authenticated without forcing the
scene any servers but on the web
selecting an IDP is a choice issue the
web service the website that implement
social login option implements really a
few of them often one or two maybe three
and so the user are faced with a dilemma
either truth an IDP that they made for
us but between a really restricted
number of choices or creating yet
another account with a the issue we know
such as password fatigue or drop-in
security so choosing a naturist IDP is
impossible so what's the privacy issue
in my act and if you consider the WebRTC
identity use case
so the user first logon on a website it
choose to use the social login tuition
and invent the websites initial ID the
WebRTC connection by using the same
identity providers then the identity
assertion is transmitted to the to the
other users and the the other user
browser will instantiate the the
component called identity / key which
will validate the identity assertion and
this allows the the identity providers
to to learn that due to user are having
a go together and so this is a useful
information for basically the identity
providers is no participating in the
local establishment and knows the same
information as the the whether chichi
service providers so we know the user
call log which when they are calling and
to whom and regarding the type of one
the user get the only one in the gate is
a related to the the sharing of the of
the camera so they may not be aware that
the the a identity providers are getting
information about the course so like I
said jgp can learn user collage and the
user should be able to use the trusted
IGP but the implementation on website is
is limiting the use of choices so in the
other end if the user could choose the
IDP what would be required for it to be
possible so the the first point is that
the IDP and the website must be
compatible using oath to the the website
must be registered on the identity
providers so that they can be so that
the website can authenticate to the to
do identity provider and in some
situation the website may need to trust
the IDP regarding the type of data the
level of authentication the security or
the identity information' that are
provided
so why is it impossible for the user to
true they are not eatable either and we
have to regress to research question the
first one is that maybe the service
require the specialized API specialized
data so that any identity provider
cannot be used the second worst research
question is that maybe the identity
provider do not implement dynamic for
inspiration that would allow the plug-in
of anywhere and any identity providers
or any website on any website and
finally maybe just a trust if you bit
between website and identity providers
so to answer that questions we did a no
study trying to find which type of data
are requested by website and its website
menu requires specialized data I will
define it later or it's the require
basic authentication that are just in
from user identity if you use social
login you may notice that this type of
pattern where the the identity providers
is requesting the user to tries the
website to access some information in
some case between different scenario so
on the right you have data Basking
authorization to share with Mozilla
developer Network and on the right learn
the left a Facebook you sketch so in
this guide the implicit authentication
is common between the two some profile
information are also come on but find
something Facebook the website is asking
to access the friend list and so this is
obviously not available on github so in
this case github could not be used by
the website on the left on the right so
this is the kind of specialized data
that would block any website to use any
identity providers so in the paper we
categorize the type of idea that are
accessed between three different level
authentication which is just a proof of
authentication or maybe just implicit
and an identifier a profile data which
are which we define as being equivalent
to the
what is defined in open education under
and any other type of data which we call
specialized so in austerity we try to
collect the oath to request you are and
these are interesting data because they
contain the identity providers the
client website that is making the
request also accessible also also we
don't available with a human readable
name and of course the type of data that
are requested so we the 500 website and
try to use any any social login option
that was present and then collected the
AWS request and all result on the left
you have so we add a to classification
because on some website the website of
the different login option sometimes
only one and we have a double
classification of a minimal type of data
that are requested and the maximal type
of data for instance in some case where
the website including Google and
Facebook and on Facebook the website is
requesting lot of data friendly is the
more information and on Google using
Google they did not implement the Google
API so just requesting the user
identifier and proof of education so on
the left on the blue it's only one type
of service and then you have the
authentication profile and specialized
class and so first this shows that some
website don't need specialized data
because a functions in this case the the
profile and the specialized it shows
that the website is a requesting only as
a minimal profile data so just a
username and saw some small information
not we don't respond user privacy but
she's also using with another identity
providers a lot more compromising data
and also so this kind of only
specialized is the type of website that
will not be compatible with any identity
provider because they require really
specialized data to work for in salsa
get up cloud or the kind of data that
will not be accessible for any identity
providers and so in total we have 58
percent of the website in Austria that
are at least compatible with
authentification or provide data so it
shows that concerning the of France with
a research question the the majority of
website could let us on to the identity
provider from this point of view we also
look at if the dynamic registration
which is also possible without an ID
connect is implemented and so in our
data we have 500 website from which we
found one on whether relying party so
website that I'm using with identity
providers in total 23 identity providers
and on undeath only five we're
implementing open ID connect only 3 with
accessible metadata and none of this
metadata we're concerned with a dynamic
fluid expression so in clear the dynamic
registration and discovery is not at all
implemented by imodium identity
providers and finally a new website
require trust from the IDP we have an
example for instance print Connect which
is kind of a trusted Federation in a
identity provider for French services
and basically the bottom line is that
the the website that would use France
connect expect some level of trust
regarding the user identity and so the
website will not be able to use any any
identity providers so can we find some
example of this in the while we look at
the collected data and we found no
example of explicit trust
scope that will have some meaning of
trust some type of data that will be
trusted by the website that I'm
requesting them so the people disease is
that is a result first a relation
between the
the website and the identity provider
it's invisible from a technical point of
view and probably due to agreement our
condition of hues and we didn't study
that part and keeps all solution to the
dynamic registration program we had
three research question and we found
that dynamic registration may be an
issue for users through the identity
providers but on WebRTC the identity
solution allows identity provider on
discovery and without crying for
registration the client here being the
website so we propose a web browser by
the identity management at the moment
it's a prototype emoji a Firefox
extension and so the website only put a
connect button on on the website instead
of all the social login option and the
user can then use that button to call an
API on the web browser that will display
a pop-up and allow the user to choose
any identity provider that it may have
previously were restored on Omnitech
functions so the when you select an
identity then call the identity provider
which provide a JSON web token with the
user identity and is proof of of
Education so we reuse the WebRTC our
non-teaching mechanism and basically
true that if this male identity
mechanism is used in a while it could be
used more largely for more identity
management stuff also and it's not in
the paper but we found it after what
there is a web payment working group at
the w3c and they are working on a
similar solution but for web payment so
basically the user configure some
payment provider in each browser and
then the website can call an API on a
browser to to to basically do the same
flow as we did with item 6 minute
another translation so in no conclusion
could use a food item to provide the
identity provider on web site in on the
Internet basically in Oakland in
observation it's not related to the type
of data that the web site our will
resting to identity provider but more
for technical connection between
identity provider on website and all
solution could a good app solve this
issue
so thank you
[Applause]