syssec_red_book

7.5. State of the ArtFinally, identity theft can lead to serious incrimination, since today a user’ssocial profile and all activities connected with it can be strong evidence forcertain violations. For example, during the last Olympic Games many athleteswere expelled from the games for tweeting racially charged content [54].7.5 State of the Art7.5.1 Delegated Authentication and AuthorizationCommunication and resource sharing between web services is a desired abilitythat benefits both users and services. The most straightforward way for serviceA to exchange information about a user with service B is for that user toprovide his credentials for the latter. This carries security risks ranging fromthe unrestricted access service A receives to the compromise of the user’scredentials as he shares them with more and more services. For that matter,delegated authentication and authorization methods have been developed asan alternative to the users’ providing their actual credentials to a service.The OAuth 2.0 authorization framework [57] enables a third party to requestaccess to a credential-restricted resource from its owner and receive that accesswithout knowledge of the owner’s credentials. For that to happen, the resourceowner authenticates with the resource server, using his credentials, and obtainsan access token which can be used in place of the owner’s credentials for therestricted resource. Moreover, the owner is able to limit the token’s capabilitiesso as to set a specific permission scope, lifetime and other attributes for thatthird party’s actions. The OpenID 2.0 authentication standard [41] provides away for an end user to prove ownership of a claimed identity to a third party.Its intended purpose is for users to log in to web services without registeringfor a new account as long as they already have a registered identity withan OpenID provider. Users visit a web service and attempt to log in simplyby claiming an identity and specifying the OpenID provider that will verifytheir control over that identity. The web service indirectly, through the users’user-agent, requests and receives an assertion about their ownership of theclaimed identity from the OpenID provider.Facebook Connect [419] is an attempt by the social network to build on topof both OAuth and OpenID to produce an authentication and authorizationframework combined with the social information and graph its users form.Other popular web parties such as Google [22] and Twitter [58] are doing thesame. BrowserID [291, 292] or Mozilla Persona is a single-sign-on mechanismthat uses e-mail addresses to represent user identities. Users are able to claiman e-mail address as their identity as long as they can prove ownership. E-mail providers take up the role of providing proof to a web service, in acryptography-secured manner, that a given user-agent, trying to log in tothat service, has also managed to successfully authenticate itself to the e-mail55