[PDF] CryptoBook: An Architecture for Privacy Preserving Online Identities
Authors: John Maheswaran, David Isaac Wolinsky, Bryan Ford (Yale University).
CryptoBook attempts to provide cross-site authentication in a privacy preserving way. Cross-site authentication is increasingly widespread: users can use OAuth and their Facebook accounts to log in to Pinterest, StackOverflow, etc. The reasons why users prefer this form of authentication are clear: they only have to maintain one account (their Facebook account), and don't have to sign up or create passwords at every other site.
The problem is that every thing a user does on a third party site can now be associated with their Facebook count, which is often not what the user wants.
CryptoBook acts as an intermediate login service. It is presented as a second login option, next to "Log In with Facebook" for example. Facebook issues an OAuth token to the intermediate CryptoBook service, rather than to the visited site (e.g., Wikipedia). The CryptoBook service vouches that the user's identity *does* correspond to *a* Facebook account, without revealing which one. In fact, the user provides a list of other Facebook accounts to act as the anonymity set - the website does not learn which of these users is signing in.
CryptoBook's backend consists of a collection of federated servers, of which only one (not necessarily a majority) needs to follow the protocol in order to maintain security and privacy. Standard ring signatures are used so that the token is provably signed by one user among this set, but it could be any of them.
Q. Why go through the effort of using crypto? Why not have the user's browser simply sign up, automatically, on their behalf, to various websites?
A. Part of the function of cross-site authentication is to protect the website against anonymous user accounts. In other words, the website may not want to accept anonymous signups, but instead only accepts legitimate Facebook accounts.
Comment: It was suggested that this work may duplicate existing work, as many state governments are busy implementing very similar things.
Q. What happens when a Facebook account is deactivated?
A. The token can be revoked. This could conceivably introduce a correlation attack.
No comments:
Post a Comment