Authentication Without Authentication

on YouTube ↗46m

" summary

Claims a workable way to authenticate an app installation without user interaction by having each device generate an RSA keypair, register the public key plus two 64-bit nonces, and sign a one-time nonce per request so the OpenID Connect provider can validate and issue a JWT. Uses IdentityServer for the provider, TLS + certificate pinning, handles replay and network failures with a 400/resync flow and revocation if out of sync, requires at least one auth/day. Raspberry Pi demo shows it working, code on GitHub. IdentityServer + custom OpenID flow RSA keypair + OTP-like nonces

AI-written summary · about

" chapters (8)

1. 0:00Introduction
2. 3:08Authentication Without Authentication
3. 8:05OpenID
4. 10:26Requirements
5. 20:38OneTime Password
6. 26:00Public Key
7. 26:42Fault Tolerance
8. 33:38Demo

" related talks

• 39mSecuring your apps with OAuth2 and OpenID ConnectRoland Guijt · Codemotion Rome 2015
• 57mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier, Brock Allen · NDC Porto 2019
• 01h 02mModern AuthenticationRob Moore · NDC Sydney 2016
• 59mSecuring Web APIs from JavaScript/SPA ApplicationsBrock Allen · NDC Oslo 2019
• 58mBuilding JavaScript and mobile/native Clients for Token-based ArchitecturesDominick Baier, Brock Allen · NDC London 2017
• 38mAuthentication as a Microservice: Portable Customer Identity ManagementBrian Pontarelli · OWASP AppSec USA 2018
• 01h 02mBuilding Clients for OpenID Connect/OAuth 2-based SystemsDominick Baier · NDC Security Oslo 2019
• 57mSecurity and Identity: Ruby, CAS, and OpenIDJustin Gehtland · RubyConf 2007