FIDO, Federation & Facebook Social login

Derek Hanson, Director of Solution Architecture and Standards, Yubico, discusses U2F and Federation, Facebook Integration & Social Login

1. All Rights Reserved | FIDO Alliance | Copyright 20171
FIDO, Federation
& Facebook Social login

2. All Rights Reserved | FIDO Alliance | Copyright 20172
Derek Hanson
Director of Solution Architecture
and Standards

3. All Rights Reserved | FIDO Alliance | Copyright 20173
AGENDA
●FIDO U2F: A strong second-factor
●U2F and Federation
●Facebook Integration & Social Login

4. ●Simple, single gesture authentication
●Scalable, one device works across an unlimited number of
sites
●Secure, protects against phishing and man-in-the-middle
attacks
●Privacypreserving, no secrets shared between sites
●Open Standard, platform/browser support, no 3rd-party
protocol
All Rights Reserved | FIDO Alliance | Copyright 20174
Why FIDO?

5. All Rights Reserved | FIDO Alliance | Copyright 20175
Where Does FIDO Fit?
Identity Proofing
User Management
Authentication
Federation
Passwords Risk-BasedStrong
MODERN
AUTHENTICATION
Single
Sign-On

6. All Rights Reserved | FIDO Alliance | Copyright 20176
FIDO U2F Challenge/Response Flow

7. All Rights Reserved | FIDO Alliance | Copyright 20177
Notable RPs using FIDO U2F

8. All Rights Reserved | FIDO Alliance | Copyright 20178
FIDO U2F and Federation
●FIDO U2F Authentication protects
login to federation account, which
holds the “keys to the kingdom”
●FIDO U2F security benefits extend
to federated logins
●Strengthens federation protocols:
SAML, OAuth 2.0

9. All Rights Reserved | FIDO Alliance | Copyright 20179
U2F, Federation, and Facebook
●Facebook added support for FIDO
U2F in January 2017
●Social logins (Login with ‘X’)
extends FIDO U2F security benefits
to federated account access

10. Benefits:
●Phishing protection
●Fast, secure logins (and social logins)
●Interoperable (1 token, many services)
All Rights Reserved | FIDO Alliance | Copyright 201710
U2F, Federation, and Facebook

11. ●Facebook social logins use OAuth
2.0 and OpenID Connect-like
extensions (Facebook Connect)
●SAML used for enterprise
federation
All Rights Reserved | FIDO Alliance | Copyright 201711
Facebook Federation

12. Scenario: Currently Logged into Facebook with
username/password & U2F Token
All Rights Reserved | FIDO Alliance | Copyright 201712
Relying Party:
IdP:
U2F, Federation and Facebook

13. All Rights Reserved | FIDO Alliance | Copyright 201713

14. All Rights Reserved | FIDO Alliance | Copyright 201714

15. All Rights Reserved | FIDO Alliance | Copyright 201715

16. All Rights Reserved | FIDO Alliance | Copyright 201716

17. ●Enable Social Authentication for Account Recovery
●Enable Users to Opt-Out of Managing Passwords
●Enable Secure and Simple to Use Social Login
●Become a Secure Identity Provider for Your
Employees, Customers, Vendors, Partners, etc.
How does FIDO & Federation
benefit me?
All Rights Reserved | FIDO Alliance | Copyright 201717

18. Read the U2F Specifications FIDO specs& github.com/dainnilsson/u2f-tutorial
Build Your Own Server https://developers.yubico.com/U2F/Libraries/List_of_libraries.html
Use Standalone Server dev.yubi.co/u2fval
Use the Online Service u2fval.appspot.com
Yubico U2F Demo Server demo.yubico.com/u2f
Google U2F Demo Server u2fdemo.appspot.com
Start Building a Better
Authentication Stack Now!
All Rights Reserved | FIDO Alliance | Copyright 201718
Learn

19. All Rights Reserved | FIDO Alliance | Copyright 201719
Thank You!
Derek Hanson
[email protected]

20. All Rights Reserved | FIDO Alliance | Copyright 201720
Extra slides

21. All Rights Reserved | FIDO Alliance | Copyright 201721
FIDO + Federation
Relying PartyIdP

22. All Rights Reserved | FIDO Alliance | Copyright 201722
AuthenticatorUser verification FIDO Authentication
Require user gesture before
private key can be used
Challenge
(Signed) Response
Private key
dedicated to one app
Public key
How does FIDO Work?