Iris: Third-Party Authentication Service Akshay Padmanabha Kevin Chen
[email protected] [email protected] Surya Bhupatiraju Thomas Zhang
[email protected] [email protected] ABSTRACT thentication and providing a centralized identification sys- Existing centralized identification systems, such as Facebook tem. To this end, we propose Iris: a web-based, secure, or Google, offer convenient services for authentication and centralized system to allow users to fully control what in- storing user information that third-party services leverage to formation they expose to third-party services, and offer full reduce friction and streamline the process of creating user transparency as to what data is collected and how it is used. profiles and logging in. However, these systems present con- flict of interests, and users may be interested in a third-party 2. PREVIOUS WORK service that focuses exclusively on authentication. To this A notable example of work towards an unbiased, third- end, we present Iris, a web-based, secure solution that re- party identification system is OpenID [6]. OpenID is a bold solves the single-point-of-failure concern and provides secure attempt in this direction, but faced many problems. One of protocols of data transmission and transparency of data us- the primary drawbacks include bad communication; it is not age. clear to end users as to how OpenID works or how it is used. Iris consists of two components: a database that holds This lack of understanding, along with poor implementation, users' information encrypted with their passphrases along security vulenerabilities, and trust issues, eventually led to with a public API to retreive this data, and a client-side OpenID becoming less and less popular.