Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
2012 Confoo: Defining User Identity
1. Defining User Identity
True Identity VS Anonymity
Jonathan LeBlanc
Developer Evangelist: X.commerce
Email: jleblanc@x.com
Twitter: @jcleblanc
2. What We’re Going to Cover
The Foundations of Human Identity
Tribalism and Social Grouping
The Big Bag of Social Identity Fail
Experimental Identity Methods
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
3. What We’re Going to Cover
The Foundations of Human Identity
Tribalism and Social Grouping
The Big Bag of Social Identity Fail
Experimental Identity Methods
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
4. Human Identity: User Types
Anonymous Users Real Identity Login
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
5. Human Identity: Open Identity Programming
OAuth (1.0a + 2.0)
PayPal Access, Facebook, Twitter
OpenID (…and the upcoming OpenID Connect)
PayPal Access, Google, Yahoo!
BrowserID
Mozilla
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
7. Human Identity: Tracking Anonymous Users
There are a few common options
Tracking Cookie Local Storage
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
8. Human Identity: Tracking Anonymous Users
Program Overview
• On each page visited, track the URL
• HTML5 Local Storage as primary storage
• Cookies as secondary storage
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
9. Tracking Anonymous Users with Local Storage
var storeName = "visited";
if (typeof(localStorage) == 'undefined' ) {
//Local Storage Not Available
} else {
try {
var sites = localStorage.getItem(storeName);
sites = (sites === null) ? window.location : sites + window.location;
localStorage.setItem(storeName, sites + "|");
} catch (e) {
if (e == QUOTA_EXCEEDED_ERR) {
//quota exceeded
}
}
}
10. Tracking Anonymous Users with Cookies
function readCookie(name) {
var nameEQ = name + "=";
var ca = document.cookie.split(';');
for (var i = 0; i < ca.length; i++) {
var c = ca[i];
while (c.charAt(0) == ' '){ c = c.substring(1, c.length) };
if (c.indexOf(nameEQ) == 0){
return c.substring(nameEQ.length, c.length);
}
}
return null;
}
11. Tracking Anonymous Users with Cookies
var storeName = "visited";
if (typeof(localStorage) == "undefined" ) {
var cookieVal = readCookie(storeName);
var value = ((cookieVal === null) ? window.location : cookieVal
+ window.location);
var days = 1;
var date = new Date();
date.setTime(date.getTime() + (days*24*60*60*1000));
var expires = "; expires=" + date.toGMTString();
document.cookie = storeName + "=" + value + "|"
+ expires + "; path=/";
} else {
//Use Local Storage
}
12. Human Identity: Tracking Anonymous Users
Next Steps / Improvements
• Remove oldest results when storage fills
• Build categorization mapping prior to
storage to save space (more on this later)
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
13. Human Identity: Real Identity Users
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
14. Human Identity: Real Identity Sources
Sources of Real Identity
Social (perceived) Concrete (true)
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
19. What We’re Going to Cover
The Foundations of Human Identity
Tribalism and Social Grouping
The Big Bag of Social Identity Fail
Experimental Identity Methods
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
20. Social Grouping: It’s Not A New Thing…
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
21. Social Grouping: Foundation in Tribalism
Tribalism started as a way to keep us safe
…it has lead to some horrible parts of history
but it is also a foundation of many of our social
relationships
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
22. Social Grouping: The Real Life Social Graph
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
23. Social Grouping: The Online Social Graph
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
24. Social Grouping: Group Types
Follower Type
Connection Type
Group Type
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
25. Social Grouping: Data Miners are Rock Stars
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
26. Social Grouping: Group Programming Primer
Program Overview
• Use all URLs from the previous program.
• Obtain content category for page.
• Categorize user interest.
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
27. Social Grouping: Group Programming Primer
Step 1: Obtain
Website Content
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
28. Social Grouping: Group Programming Primer
Step 2: Perform
Keyword Density
Search
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
29. Social Grouping: Group Programming Primer
Step 3: Weight
Keywords
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
30. What We’re Going to Cover
The Foundations of Human Identity
Tribalism and Social Grouping
The Big Bag of Social Identity Fail
Experimental Identity Methods
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
31. Social Identity Fail: Personal Safety
When Social Discovery Impacts Personal Safety
“My privacy concerns are not trite.
They are linked to my actual
physical safety”
--Harriet Jacobs (Gizmodo)
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
32. Social Identity Fail: Privacy Concerns
When Making Things Easy Impairs Privacy
“Path Uploads Your Entire iPhone
Contact List By Default”
--Mark Hachman (PCMag)
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
33. Social Identity Fail: The Fine Line
The Fine Line Between Insightful and Creepy
“How Target Figured Out A Teen Girl
Was Pregnant Before Her Father Did”
--Kashmir Hill (Forbes)
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
34. What We’re Going to Cover
The Foundations of Human Identity
Tribalism and Social Grouping
The Big Bag of Social Identity Fail
Experimental Identity Methods
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
40. Experimental Identity: WebFinger
profileUrl name
id formatted
thumbnail url family name
urls given name
photos display name
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
41. Identity Programming Core Concepts
Identity is more than just a login
Authentication is just the first step
Find the tool that:
– Has the raw data that you need
– Works with your business
X.Commerce (eBay Inc.)
http://www.x.com | @x_commerce
http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/The statistician is now a rock star