【Overseas Event Introduction】Jamstack Conf 2021 Security is the "s" in Jamstack by Maricris Bonzo

The speaker for this session is Maricris Bonzo, an engineer from the company Magic.

 

We provide distributed authentication services.

 

How can security be ensured in Jamstack?

 

They introduced four approaches as methods for personal authentication.

Security-related issues

It is a common method to have users log in and register their personal information when using the system.

 

However, at the same time, you will also be faced with the following risks.

 

[Service Provider]

As the scale expands, the need and pressure to manage data properly increases.

[User Side]

Worried about how personal information is managed and data leaks. (How will my data be managed...)

 

How can we address this issue when using Jamstack?

Authentication Methods

As a major premise, there are two main types of authentication methods.

 

1. Centralized Authentication

Traditional authentication method. Aggregates and manages user's personal information data.

 

It seems that terms such as centralized authentication, consolidated authentication, centralized authorization, and centralized authentication are used in Japanese, but there is no established expression.

 

In this report, we will refer to it as "centralized authentication".

 

2. Decentralized Authentication

New authentication method. Each user manages their own personal data.

 

"Distributed authentication" is a commonly used term.

4 Approaches

This is the main topic.

 

Approach 1: Creating a Centralized Authentication System

 

There are ways to use IDs and passwords, or issue tokens.

 

There are advantages to the system being able to manage data, making it easy to create and customize according to its purpose.

 

On the other hand, from the perspective of managing data, we cannot overlook the risks. Even if we use libraries, it is extremely difficult to find reliable open source ones.

 

Approach 2: Creating a Distributed Authentication System

 

To reduce the risk of managing data on our own, the concept of distributed authentication has emerged. Instead of the system centrally managing data, each user manages their own data.

 

Store keys and certificates on your mobile phone, etc., distribute them on the blockchain, and present only the necessary data as needed.

 

However, it may be difficult to create on your own and it may also be difficult to ensure reliability.

 

Approach 3 Outsource Centralized Authentication

 

This is a common method that is currently used to authenticate with other services using APIs.

 

Multi-factor authentication (MFA) and single sign-on (SSO) are applicable.

 

This is also an easy way to create a website on Jamstack.

 

Services with high compatibility include Auth0 and Firebase. It is a great attraction that you can easily incorporate them just by learning how to use their APIs.

 

However, no matter which centralized authentication service you use, there will always be a risk in having all data managed in one place. If that service goes down, it becomes unusable. Additionally, there is no doubt that the number of people who resist not being able to manage their own data will continue to increase in the future.

 

Outsource Approach 4: Distributed Authentication

In a decentralized authentication service, instead of a user ID and password, a secret key and public key managed by blockchain are provided.

 

The company Magic, where the speaker works, is a specialized service provider.

 

Those secret keys and public keys are, so to speak, "something that physically strengthens traditional user IDs and passwords".

 

These keys generated by elliptic curve cryptography do not contain any personally identifying information.

 

Therefore, it is also possible to migrate and use other services.

 

Usage methods may vary depending on the service provider. Magic provides an API that can be used with plug and play (implementation is very easy!).

 

User information and data belong to the user. It can be said that they are in line with the future trend of thinking.

 

However, being in the process of growth in a new field is both an advantage and a disadvantage.

 

There is no established standard yet, and it varies depending on the provider.

 

In addition, you may feel somewhat limited in what you can do because authentication will be outsourced.

Comparison of Approaches

We have compared the four approaches introduced so far.

 

 

The result is that the third or fourth outsourcing approach is advantageous.

 

In addition, the following points should be taken into consideration.

 

1. Developer's Ease of Use

 

2. User Experience

 

3. Provided Functions

 

4. Level of Support

 

5. Current and Future Expenses

 

6. Strictness of Privacy and Security

 

7. Can users have sovereignty over their data?

Summary

The concept of distributed authentication seems to be gradually gaining popularity.

 

Microsoft

（https://www.microsoft.com/ja-jp/security/business/solutions/decentralized-identity）

NTT Data

（https://www.nttdata.com/jp/ja/data-insight/2020/122302/）

 

Recently, there has been a trend towards extreme strictness in managing personal information.

 

With regulations such as the EU General Data Protection Regulation (GDPR) becoming increasingly strict, it is becoming difficult for Yahoo Japan to be accessed from Europe, and even Facebook may become unusable...

 

As a result, there are benefits to managing personal information data in a decentralized manner, rather than aggregating it through a centralized method where others are not involved.

 

In addition, obtaining authentication through an API is in line with the design philosophy of Jamstack, and can be considered a good approach in that it does not incur unnecessary responsibilities.

 

However, the reality is that there are few people who have actually implemented it, making it difficult to find talent.

 

That's why it might be a big advantage to touch on this method early on!

 

Thank you for reading until the end.

 

Human Science Co., Ltd. offers unique solutions for web content and platforms using the combination of "document creation know-how" and "the latest web development technology (Jamstack)" that other companies do not have.

 

If you are interested, please contact us here!

 

Human Science Co., Ltd.

https://www.science.co.jp/document/jamstack.html

 

Source of this document: https://www.youtube.com/watch?v=FFQctR6w11M