IndieAuth - Distributed Web Identity

Internet Identity Workship - May 6th, 2014

IndieAuth - Distributed Web Identity

aaronparecki.com

Who am I?

Who am I?

https://facebook.com/aaronpk
http://www.linkedin.com/in/aaronparecki
https://github.com/aaronpk
https://google.com/+aaronpk
https://foursquare.com/aaronpk
http://instagram.com/aaronpk

aaronparecki.com

IndieAuth:

Your personal domain is your identity
Sign in to websites without creating an account
Easy for users to implement, just add a rel=me link to your Github profile (no really, try it! Full instructions on indieauth.com)

IndieAuth:

Supports new and extended authentication mechanisms with no changes to the consuming site or the identity
- Mozilla Persona
- SMS Verification
- Google Authenticator (TOTP)
Using TOTP or SMS you can even sign in on an untrusted computer without entering your password!

Live Demo!

Delegating auth to a third party

What just happened?

The IndieAuth server requests aaronparecki.com and looks for known auth providers
Presents me with a list of options to choose from
I choose GitHub, and am sent over to GitHub.com to authenticate
The IndieAuth server verifies my GitHub login and returns an auth code
My website verifies the auth code with indieauth.com and starts a session

Live Demo!

What just happened?

The IndieAuth server requests aaronparecki.com and looks for known auth providers
Presents me with a list of options to choose from
I choose TOTP, and enter the code shown on my device
The IndieAuth server verifies the 6-digit code entered and returns an auth code
My website verifies the auth code with indieauth.com and starts a session

So this relies on indieauth.com to run this service?

- You, just now (probably)

IndieAuth.com is this app's auth server

In this example, the IndieWebCamp wiki is using indieauth.com as a service
Analogous to Google running an internal...

Delegating IndieAuth

aaronparecki.com

			<html lang="en">
			<head>
			    <title>Aaron Parecki</title>
			    <link rel="indieauth" href="https://indieauth.com">
			</head>

Delegating IndieAuth

aaronparecki.com can delegate to any IndieAuth server
The site I'm signing in to trusts the IndieAuth server my site delegated to
My site could even be its own IndieAuth server

spec.indieauth.com

Thanks!

Try it out: indieauth.com
Read the draft spec: spec.indieauth.com
Learn about the #indieweb: indiewebcamp.com