Eric Sachs Director of Product Management Identity, Google. Pam Dingle Senior Technical Architect Office of the CTO, Ping Identity

Transcription

1 SESSION ID: IDY-R05R Identity Standards at Work in Google's Mobile-Focused Future Eric Sachs Director of Product Management Identity, Google Pam Dingle Senior Technical Architect Office of the CTO, Ping Identity

2

3

4

5

6

7 (555) Enter We sent Google a verification Account PINcode to (415) Forgot PIN? Finding your Google Account with MobileCo

8

9 Sign in & registration on mobile is too painful E

10 Save Eventbrite password securely with Smart Lock?

11

12 Early integrations in an afternoon of work - client side changes only. NETFLIX 20% reduction in lost password support cases The New York Times 80% auto sign-in rate alixnish@gmail.com Linkedin 14% increase in sign up conversion

13 Don t overthink

14

15 Not registered Registered

16 YOUR APP Choose an account Eric Sachs Eric Sachs address Eric Sachs NEXT CANCEL new user? returning user with password? returning federated login user? Select authentication method Input existing password Authentication at Identity Provider

17 New UX, New Signals - backed by Standards You can have the same UX as Google Simple Login Hints protected by consent, standards Overseen by OpenID Foundation Two added features Identifier-first form Protocol support for OpenID Connect login_hints Cast: The IDP: Integral Curve The RP: Hipstabank The User: Alice Try it: demonstrates Federated Flows

18 What you Saw in the Demo Login Hint Hipstabank signalled Integral Curve to help initiate a login Identifier First Login Flow Integral Curve took the hint, only prompted for password Account Record Stored Hipstabank pushed an identifier and provider id into Account Chooser AccountChooser Record Selected Alice can click once to discover IDP, identify user, initiate SSO

19 What you Saw in the Demo Account Event Detect & Publish Signal Generation Downstream Security Decisions Session invalidation Token Revocation

20 YOUR APP Choose an account Eric Sachs YOUR APP Choose a method YOUR APP Choose an account Eric Sachs esachs@google.com Eric Sachs eric@gmail.com Thank you for registering, Eric Eric Sachs address esachs@google.com eric@gmail.com Eric Sachs eric@gmail.com address Create a password eric@gmail.com CANCEL NEXT address Eric Sachs eric@gmail.com eric@gmail.com CANCEL NEXT CANCEL

21 YOUR APP Choose an account Eric Sachs Eric Sachs Thank you for registering, Eric Eric Sachs address Eric Sachs NEXT gmail.com? Google Fast IDV Yep! CANCEL

22 WebView: insecure, no shared session

23 WebView: Even trusted developers create risk Third Party SDK Third Party SDK Trusted Developer Enterprise Third Party SDK In the News: Apple Removes Over 250 ios Apps With Ad SDK That Collects Personal User Data

24 Data: Sign-in abandonment rate 54% of users abandon app sign-in flows when no authentication state is present. Data aggregated from a week of sign-in prompts by Google Sign-in for ios.

25 Browser tabs: secure context, shared session Auth request Auth response

26 Google Sign-in for ios The Google Sign-in library for ios implements this best practice today.

27 Implement Browser Tabs for OAuth today! IETF Internet-Draft: OAuth 2.0 for Native Apps Open Source Client SDKs: AppAuth for Android and ios

28

29 All you need to do is build this

30 Google Identity Toolkit Sign-in Methods Benefits Simple getting started Front End Platforms High conversion end user UX Best practices in security Server Frameworks

31 For your employees... Pick an IDaaS provider: Azure AD, Ping, Google Apps, Okta, Or combine them as Netflix did (Google Apps + Ping Identity Bridge )

32 Search for Google Internet Identity Research to find these slides and others from Google