Maximum security and maximum user comfort: until now, you couldn't have both. Experience shows that today's "homo interneticus" rarely complies with the requirements set by security officers: password hygiene is a foreign concept to him, he uses one single access code for everything, and he is hopelessly lost in the jungle of user accounts. Experiences such as these call for new answers – such as Airlock's social logins and bring-your-own-identity functionality.
The new OAuth 2.0 and OpenID Connect standards offer an alternative to the confusing jumble of passwords. These standards make it possible to re-use existing user identities for applications throughout the internet. An important aspect: Gartner forecasts that half of all new customer accounts will be based on social network logins by the end of 2015. This means that businesses will make more of their applications available for "Login via Facebook" instead of foisting yet another account and password on the user.
There are also a number of foreseeable applications in the B2B sector. OAuth 2.0, for instance, is HTTP- based, making it ideal for protecting RESTful web services. The potential of the new standards can be exploited to the full when authorization for enterprise APIs is needed – for example, to allow access to partners.
The new standards should also be considered in architectures that provide for federation of user identities and composition of APIs from different areas.
- Password-free authentication
- OAuth 2.0
- OpenID Connect