[JDEV] Re: Verifying Jabber + External Ident apps + Presence scalability + New protocol ideas submissions

[Oliver Wing]

> Perhaps it would help if I filled everyone in on
why we want to do this.
> Basically, we are interested in creating an
Identity system that as well as
> replacing the vCard ident system acts somewhat
like Microsoft Passport,
> where websites can access and store their
information in the user account
> database, instead of forcing the user to create
separate accounts with
> separate passwords for each site etc.

If we start by exploring what Passport actually
does. A site wishing to use the technology must
signup to the scheme, past rigerous security
procedures, and then is granted the ability to
receive passport information. The passport website
& servers do the authentication itself. Websites
are sent information authorised by the user.

Users have therefore given their trust to
Microsoft, well more specifically passport.com.
They trust them not only with their personal data
but also in some cases credit card details.

> So we need to be able to ensure that when a site
is given a JID, that the
> user can authorize that site to access their
personal info. We could do this
> by having the site subscribe to the presence of
all it's users, and by
> embedding the users IP into presence (is this
acceptable privacy wise?) it
> would ensure that the given JID could be
verified against the IP of the
> computer attempting to access the site, making
taking over somebodies
> account very difficult unless you know the
password.

IP Addresses can not be assumed to be unique. This
is not only for NAT's but also for the many ISPs
who run transparent proxies. The Jabber connection
may be on a completely different IP, secondly many
users may be trying to access the site from behind
the same proxies. Therefore any user can get
access to any other users account.

My idea is the same as the passport system, but in
line with the Jabber prinicpal of distribution.
Trusted safe houses can be establish, similar to
the various organisations distributing accepted
SSL certificates. Sites wishing to use Jabber
technology could allow users to use these safe
houses to authenticate them.

The site would redirect to the Safehouse for
authentication. The user can then decide whether
they trust this safe house. The safe house could
be a users Bank, a well known firm such as Disney,
or simply somone like jabber.org. They can then
pass the site details the user wishes, such as
one's name for personalisation, credit card
details for shopping, etc..

Indeed, by making the Safehouse one's bank, it may
perform the transaction completely privately on
their network, never exposing any financial
information over the wire. Likewise, a
pay-per-view site, such as these Adult
Verification Systems could use the technology to
authenticate. Once a connection has been made to
the Safehouse, no further authentication need take
place for visits to subsequent sites.

It is not the cleanest of systems, but then
clients could have the ability to automatically
verify with a Safehouse built in, like MSN
Messenger has with Passport.

Just my thoughts (as expressed in JDev conference
earlier)

--
Oliver Wing