From Hollywood, it's time now for Edmund O'Brien as Johnny dollars That's right Yes, I did your insurance company wanted me to look into this trouble with your wife I wonder when I could see it. I understood you were worried about a disappearance that you hadn't heard from her in over a week Isn't that it? All right, Captain Woodstock. I'll be out to talk with you this afternoon Edmund O'Brien in another adventure of the man with the action-packed expense account America's fabulous freelance insurance Investigator yours truly Johnny dollar expense account submitted by special investigator Johnny dollar to home office Washingtonian life insurance company a Hartford, Connecticut The following is an accounting of expenditures during my investigation of the seal your Woodstock matter Expense account item one twenty five dollars and fifty cents car rental and mileage to the Woodstock home off the highway just east of Bridgeport There's a large frame house shuttered against the cold Icy landscaping swept down to the shore where an empty dock stood against the winter wind blowing across Long Island sound Captain Lyle Woodstock, please. Yes, sir. You are mr. Dollar. That's right. Come inside. Thanks. I Am captain Woodstock nice of you to come out Nasty wind isn't it? It wasn't blowing like this in Hartford where oven windy here in the sound I'm afraid you'll have to leave your coat here. I just charged the servants all of them Good to stomach the ratitudes in Celia's departure. Come along. We'll talk in the library How did you happen to turn to your insurance company mr. Woodstock? Yes, it would seem unusual wouldn't it? It seems unusual that they were father with it unless they thought she'd met with bodily harm But you told me you don't think so After you mr. Dollar Maybe but set the mount of deception when I spoke to mr.. At the Washingtonian company Miller's Sam Miller Yes, mr. Miller to a delicate choice of words. I'm afraid I intimated that I was frightened for Celia's very life Sit down. Why the deception? Naturally to interest them in the situation and with a purpose Can you afford to hire a private detective my good man?  David Slater? He was recommended as the best in Bridgeport considering his dismal failure you surely understand while I felt it necessary to turn to someone else my Insurance companies got me as a wise choice since there's a large policy on her life. All right. I'll talk to this later Now will you give me everything you can on your wife descriptions on yes, they're on the table and brought out a few photos And that yeah, oh 27 Yeah, that one was snapped on Dr. Stave Beach on Jamaica Striking woman isn't she? Yeah, this one was taken while we were anchored off. He low last summer you get around travel has its advantages Mr. Dollar your boat. Yes 64 foot schooner in dry doubt moment The matter of fact I met Celia because on an impulse. I put in to be a deli quest instead of that And it seemed that she too wanted to travel Where do you think she's traveling now? I haven't the faintest idea I Started to tell you were being troubled by a certain suspicion She was in seeing entirely too much of a young doctor in Bridgeport The name is Masters Dr. Charles You think he could have had something to do with her disappearance. Now what you mean? No, I shouldn't like to say I Believe that she is a quite perfect physical specimen yet. She visited this doctor fellow at least three times a week Anything else? There is a matter of fact. Yes, we were in a capulco two years The rest of the story wasn't too far from typical although I don't need too many of the breed a 55 year old Woodstock captain because he owned and gave orders on a schooner had dedicated his life to what he called Adventure and B the 27 year old Celia had also dedicated her life to what she called adventure the results were a number of voyages and finally Celia Woodstock's disappearance Except for the doctor. I didn't learn what had gone on between I Found the private investigator David Slater in a conservatively crummy suite of offices on Front Street and Bridgeport Madam, we know what type he is. Yes. I follow this wife What did you do a better report on every move she made for a month? You want to see it? Oh, none of you remember the highlights about this dr. Charles Masterson.  Maybe she was sick Her husband says no. Well, I didn't find out. I couldn't have talked to the doctor without letting out who I was He had a nurse who put the day before I left the case. You didn't talk to her. I was going to but after I left I didn't why should I? Do you know who she is where I can find him? Yeah My name is Janet Squire You went to work in a Red Cross blood collection center up on Union Now what about the day she dropped out of sight? Is there anything special with something special? I wouldn't have lost her I'm no lucky in this business Bought a ticket in New York City on the 345. So did I I got in the same car She did I didn't see her but I figured she was powering her nose or something Then when she didn't show before the train left or went through the rest of the cars I never picked her up after that. She knew you were telling her. You must have Must have got on the car and then right off That and the money she drew out of the bank makes me think she was running out on old Woodstock and nothing else No money was mentioned to me. That's funny with stock new body $2,000 a morning she left. I wonder what else the old renegade is holding out on me Phone calls you made. I didn't say anything about any phone call Well, she made quite a few from public booths. I finally got into one next to her I couldn't get the number but she talked to somebody named spray Didn't say much but the name and then asked what do you want me to meet you? When she was answered she said all right. I'll let you know when everything is arranged and that's all Well, that's not for me. He thinks he's got a free wife chaser in these mistaken He's going to drop it sure if that's the way it is I gave up that kind of work a long time ago. I don't like it What's this? Where's Woodstock? You do anything else.  What's happened. Who are you?  I'd you find a gun. Where's Woodstock? You come this way now move down the hallway. Why I'll kill you if you don't Came in here.  You don't even know who I am. You're in trouble Maybe I can help them like that Turn around again Open the door and get in the closet. I'll wait a minute. Please Please do what I tell you Won't make any difference if I kill you Maybe I just more of a chance if I did But I won't if you don't make me Okay Very to moping and closing nearby doors and shortly after that the front door closed And I started kicking my way out The paneling was heavy and it cost a torn trowel egg and a scraped shin before I made it. This is Woodstock This is Woodstock. He'd given himself some more time by pulling out the phone wires But it took less than five minutes for me to cover some 200 yards to the nearest neighbor Explain myself and get through to the Bridgeport police A short time after that. I met homicide lieutenant Al Jester and with him watched two ambulance attendants start Mrs. Woodstock toward the hospital What's the condition boys? Can you tell it's bad lieutenant her right lung? No chance of a statement I guess it depends on her how hard or easy this thing is gonna be yeah, but better than I can't on them I've been disappointed too often What else did Slater tell you that's about all she'd drawn $2,000 the day he lost her on the train He said he'd heard her talking on the phone to somebody named Sprague about where to meet him and about some arrangements of some kind What about Slater? Is he clean? If he isn't he's careful. He stays out of trouble I guess the worst thing I can say about him is that he does a lot of divorce. I just wondered I had no reason not to believe his story. He said as far as he was concerned the girl was running out on a husband The more I saw that the Lord looked that way to me too, and I came out here to drop the case and it blew up in my face The man he described here, but he had been this spring. We could have I didn't ask him He was half crazy If he was praying and I'd thrown the name out of him. I'm afraid he'd have killed me. He was that bad Can you describe the gun? Yeah? Cheaper valve a nickel plated short barrel 32 caliber sure that I guess a smart lawyer could keep you from swearing it was a 32 But it was I'll take that I Got only one definite thing out of him. He said Woodstock was gone.  I didn't hear him drive away. I was kicking up some noise getting through that door But the people in the house where I phone said they saw it leave the next house that way our sergeant Next house towards Tom people saw a car leave send a man over and get what you can on over you So they didn't hear any shooting you didn't see a car when you got here That must have been parked on the other side of the house, and I'll get it roped on a snow or to hold some good prints of tires And did I get the amount of the insurance in the victim right $100,000 standard just a yeah You better go upstairs. I was shooting up there too. Oh, yeah in the hallway It's hard to back. Yeah, it says as a man lying sort of half into a room But there's no question about it. This one. He's dead We will return you to the second act of yours Julie Johnny dollar in just a moment Have you heard the new sing it again the new comedy with Jan Murray as your host on the coast to coast bone The new cash prizes for cracking the mystery of sing it again phantom voice the new speed and color of the tuneful little riddle songs It makes sing it again a Saturday night must for radio listening Be listening for a sing it again tonight on most of these same CBS station Now with our star Edmund O'Brien. We return you to the second act of yours Julie Johnny dollar I don't want to handle any of the light switchers right back there.   He couldn't have been all right, could he I guess not Well, let's get out again till the photographer show up Neither the photographers nor the fingerprint man nor a thorough search of the house resulted in any progress By the end of that first day Description of the man I tangled with it from broadcast along with a possible description of the car he was driving The police had also put out a futile search on the single-name spray Emilia Woodstock hadn't died, but she hadn't regained consciousness either or shown any signs of recovery I took a hotel room and bridge for that night where I'd be called if and when anything happened nothing did The next morning I went to the Red Cross blood collection center to talk with a nurse who had recently resigned the office of Celia Woodstock's friend and or doctor had come in with my mind tossing motives for murder motives of personal greed and selfishness and hate There was almost a shock to suddenly face a segment of this country Citizens old ones young ones men and women Quietly going about the business of helping the best way they knew how I Stayed to give my own blood after Janet's choir talked with me And I knew it would go all the scenes in the best of company. We can go in here. Thank you Sorry to bother you miss choir, but I was told that you were in dr. Charles Masterson's office until a short time ago You've seen the morning papers no, why do you ask Mrs. Lyle Woodstock for a shot last evening? She's one of dr. Masterson's patients Was she seriously injured they don't know if she lived Her husband was killed at the same time What happened I don't know I'm working with the police on it I'd like to learn as much as I can about Mrs. Woodstock. I'm afraid I know very little She was a patient but other than that. I know nothing Her husband seemed to have the idea that she might be More than just a patient that they might have been romantic interest between them Uh-huh, was there was not that I know of and they get a point to do very little pride into other people's affairs Mr. Dalla sometimes I wish I could You know anything about anyone named spray? Ray No, I'm afraid I don't I'm sorry. Oh, my I Yeah, I hope the results are better when you start working on me I am sorry, mr. Dollar if you'll step right through there miss file will take care of you Telephone check with Lieutenant Jester about an hour later added nothing He'd been in communication with Mexican authorities, but they were unable to come up with any leads on Celia Woodstock Or even proof that she'd been in the acropoco vicinity two years ago when Woodstock had told me he'd married her Homicide men were searching the captain's schooner, and they were still working on the name spray. I Played my last card and went to see dr. Masterson Mr. Dollar, I'm sure you realize why my name mustn't be dragged into it It won't be if it doesn't belong there doctor either was absolutely no basis for his suspicions Whatever made him say anything like that. He had a detective following her. He had an idea She came to your office too often then why didn't he talk to her he did He said something about a sinus condition and heat treatment. That's precisely the truth. I resent your attitude, mr. Dollar And puts us on a par your attitude doesn't set so well with me Keeping your name out of this case isn't as important as clearing it up no matter what you think But I know nothing about it. You must have talked to the woman as often as she was here You must have become fairly well acquainted No better acquainted than with most of my patients. Well, I don't ask for any more Why don't you talk about why the conversations were unimportant talked about a travel They'd come here from Florida to have some work done on their yacht. You talk about a husband. Yes, occasionally General things like what I? Realized that he was much older than she was but that she was quite satisfied with their marriage and their life together That's what makes his suspicions of me.  She was happy with him never anything about unhappiness about leaving him No, they were planning on a trip to South America in a few months Dr. Massison did she ever mention anyone named spray? Break yeah, it's great. I This is one of the strangest things that's happened to me in a long time Why she went to pieces because of that name completely and helplessly to pieces Just before she stopped coming for treatment What happened the last visit she made the afternoon about a week ago Someone telephoned and asked for a mrs. Amel spray My nurse and receptionist called in and asked if mrs. Sprig could answer the phone was the nurse misquire No, no, she just let me it was miss Hall who didn't know my patients by name But one mrs. Woodstock heard the name sprague. She went into hysterics. I Gave her a sedative and she was calmed. I wanted to ask her about what had happened, but I didn't There was something about her that begged me not to I decided to wait until she came back But she never did. Well, it's Amel sprague now. I'm Sorry, I was hesitant mr. Dollar I Have seen the works now see what we can make out of it. How's mrs. Woodstock still alive chest wounds are bad though There's how the shooting stacks up so far.  He was shot from behind when it was going into the upstairs room Apparently chased up there He had a gun in his hand and he dropped when he was hit that was the gun we found on the floor 38 caliber the lipstick says and run any comparisons has yet. No I won't buy the theory mr. Mrs. Woodstock seem to have been pretty happy What about their school? Well, I talked to my men on the phone nothing yet crewmen are all available and with alibis But what's all that got to do with somebody named mrs. Emil sprague? I Couldn't answer nobody could But close to 12 that night the lieutenant told me that mrs. Woodstock was finally responding to treatment and would likely live I was at the hospital at 12 30 But it wasn't until almost three that lieutenant Jester and I ever told that she was conscious and able to answer some questions Good morning, mr. Woodstock Feeling better and my name is lieutenant Jester. This is mr. Dollar. How long this is what's that? We're both interested in what happened at your house the other evening Mrs. Woodstock do you understand what we're saying to you? Do you understand? my husband My husband's mile They told me he was all right Yes, yes, mr. Woodstock. He was shot they tell you that yes, you know who did it? Yes, I know I Was there I remember we wish you'd tell us what's that? Amos break. Yes Yes, Amos No one else was there made you go where to my house To talk to my husband. Amos break made you go. Why how could he make you go? Because I'm missus. Hey, you are missus. Amos break. Yes But you were married to mr. Woodstock. I shouldn't I think I understand you were married to spray You married Sam was never ended, but you married Woodstock anyway. Yes. I was wrong and then it was money He wanted money Spray. Yes, I didn't know where he was Mexico. I had to get away And I'm married I I'm afraid it isn't spray followed you here from Florida. I Picked him up The $2,000 you drew from your bank. I gave it to him.  What's the drawer? Why didn't he shoot Amos instead of me? Are you sure of that Woodstock shot you going to the drawer? I remember You know where a sprake would go What happened? What does my husband say he hasn't said anything? Evidently spray chase him upstairs shot him there and left You know where he'd go back to Florida. No, we don't think so We've got a good description of him in the car. He was driving.  No, it's a big building Apartments, which one is spring? It's um a Number 12 Do you have a phone in the room? pleasant Well, thank you, we won't bother you anymore Thank you. What's that? I want to help my husband. I'll do anything I can I want to know We'll tell him this is a what's that? We'll have to three Producers trucks are gonna be rolling on commercial street before long Thinks break will give us trouble. Yeah. Yeah, he's been holed up since the shooting I think he's probably father of is not the one I saw him. We might slip on him. It's time in the morning I'll get some men started out there. You better come with me. I need you to identify Men should be set in the back of the building. All right, you'll go in with me Donald and I took a look at the floor that corner one up there There's a door to another room right across from his soul. We want to keep him from firing if we can We didn't want anybody because we want to keep it quiet. I hope it stays that way. All right, surgeon Let's go cross. Good luck Lieutenant the window. He's on to it. We better go on across He's on to it. It's been watching at the window. I saw him move You better see what you can do on the phone then phone. We thought if you couldn't catch him off guard We'd try and talk him out. There's a payphone on the hallway Room's just to the right at the top of the stairs that phone's right in line from up there and we'll cover him Okay, dollar if you're ready You'll do something with it. Hello a sprague We just got a complete statement from mrs. Woodstock your blackmail the works Yeah, and she's gonna make it you should have done a lot of things Or we want you to do right now is to give yourself up without any trouble Every door in the building is covered by police.  Are you listening to me?  Yes, sir. I'll go phone in keep the people away as best you can Spence account item two forty five dollars miscellaneous hotel meals, etc. Spence account total seventy three dollars and sixty cents remarks. I Understand the lawyers for the Woodstock estate are already measuring ways and means to cut the bigamist wife out of the estate I don't think the Washingtonian company has a chance of doing the same with the insurance money yours truly Johnny dollar Yours truly Johnny dollar stars Edmond O'Brien in the title role and is written by gildowd with music by Wilbur hatch Edmond O'Brien's latest picture is a Paramount picture production the redhead and the cowboy featured in tonight's cast with Francis X Bushman Jim Nussar Ted Osburn Lorraine Tuttle Bill Johnstone to their own and Ray Hartman yours truly Johnny dollar is produced and directed by Jaime del Valle This is dick cutting inviting you to join us next week at this time when Edmond O'Brien returns as yours truly Johnny dollar There's a very charming very amusing young couple to be found at CBS the stars address every Saturday evening And you're invited to stop by and call on them They're Liz and George Cooper and Liz is played by the lovely red-haired Hollywood comedian Oceal Ball This is nice and easy-going when troubles ahead Liz goes for it easily. It's wonderfully hilarious It's my favorite husband starring in steel ball every Saturday evening on most of these same CBS station They tune now perform the Rose caravan which follows immediately over most of these same CBS station This is CBS where you laugh at Jack Benny every Sunday night the Columbia broadcasting system


This is Ibshah and Ankit from India. So like next door's neighbors. And we are really excited to be here today for the second time in the last three years. And it's all been possible because of the amazing organizing team and everyone who works so, so hard to make this event a success year and again. So thank you. We both work with Jamalto in the domain of Digital Security, which is now a part of Thales. Today we are going to take you through this journey of what's going on in the world of authentication, what's new, how everything works under the hood, what new technologies have come up in the last few years, and basically why should you care about it all? So everything revolving around authentication. So basically to start with, when I flew into UK, the officer at the immigration asked for my name. So basically that's me identifying myself and then the gentleman asked me to patent my fingerprints to verify it is indeed me, Ankit, who I claim to be. So that is authentication. And now even though I'm allowed to roam in this beautiful city, yet I cannot meet the queen. So because I'm not allowed to do that. So that's authorization. So identification, authentication, and authorization, who you say you are, who you can prove you are and what you can do. So now before we talk about what's new in the authentication domain, let's talk about what's old, passwords. The most basic and vulnerable form of authentication is when you provide a username and a password. Think about it, that digital world has evolved over the years, but we are still using the same technology of username and passwords that was devised over 50 years ago at MIT to control the amount of students and professors could spend on the university's time share computer. Now that so much sensitive personal and financial information is stored online and sent over the internet, there is a greater need to invade the way as we authenticate, now more than ever. As we get closer to the 16th anniversary of digital passwords, the calls to ditch the technology are getting louder and more widespread. As we have seen, the vulnerability is related to this in terms of hacking passwords and breaches over massive scales, time and again. And as you can see in the image, identity theft is the most common one, breach and it has been the most common source of attacks since years in a row. And it is rightly said, just as nuclear war, the strategic warfare of the industrial era, cyber warfare has become the strategic war of the information era. And now we have seen some massive data breaches over the years, like in the late 2014s, Yahoo's account was hacked over half a billion accounts leaked in a large scale data breach. Yahoo has confirmed that over 500 million users' accounts were exposed in this massive data breach. Same happened with the Dropbox, where 68 million user accounts were compromised in the 2016, where attackers exploited an improperly secured employee password to obtain the email addresses and hashed and sorted passwords from breach to account that were created in the 2012 and earlier. There is one more case with the LinkedIn. The accounts of 170 million people were compromised in 2012, but the data stayed in a private hands until it is unexpectedly appeared on the dark web in the 2016. So it is actually very common to see data being breached and accounts being hacked. In fact, if you're not aware, there is a very cool website that lets you check whether any of your account has been compromised in any of the data breaches or not. So you just browse this website and enter your email ID and it shows you a record of breaches related to that account, if any. So do check this out if you are interested. So moving on to then, what is it with passwords that makes them so unreliable and undesirable when it comes to security? So basically, there are some problems with the password. The first one is passwords are simple and they are easy to crack. So let's take an example of Amazon.com. So if you want to register yourself on Amazon.com, you can just provide a password. So basically the password that you can provide there is only six, it only needs a six characters long password without any special characters or anything. So you can put it like one, two, three, four, five, six, or A, A, A, A, A, A, whatever you want to do. And in fact, according to a security company, Splashdata, the two most commonly used passwords are one, two, three, four, five, six, and the name password itself. The second one is the complex ones, which are hard to remember. So while recommendations on using cryptic and hard to guess, and hence remember passwords, which leads to what? Tightening the rules for setting passwords. So suppose there's an organization that wants you to set a password that is hard to guess. Suppose think of a word, a password. You need to make it at least eight characters long, but not more than 12. Don't repeat any of the characters more than twice. Make sure it has at least one number. And in fact, it has to start with a number. You can't use a username or any password. You have tried in the past. And finally, you have to use one of these special characters somewhere in your password. The third one is, so the second one leads to the third one, if you use a complex password, which is hard to remember, then what you end up with is you end up with resetting your passwords the next time you log in because they are hard to remember. So what it does is they are hard to remember what you would do. You will write it down somewhere so that you can remember it. Or you just reset it the next time you enter in your account, which means extra time spent by the users and IT for resetting the passwords. And on an average, the IT persons spend over 12 minutes per month for a user if any of the passwords are being resetted. And the fourth one is reusing passwords. So basically this creates a domino effect that allows hackers to multiple accounts just by cracking a single password. So as you can see in the image, these are the top 20 most common passwords of 2019 and one, two, three, four, five being the winner again. So now to recap the problem with passwords, let us quickly look through how it is actually going, goes while dealing with the passwords. So suppose you set up an easy to remember password, but then it's too simple. So then what you would do, you will write a hard to remember or a password that contains special characters and is not easy to hack. So the website ends up having complex requirements for setting the password and which eventually leads you to write them down somewhere like this and now because the password is so complex, you either keep getting it wrong or end for getting it all together and if you then go through the pain of resetting your password. Even after successful password change, you keep entering your old password for a really long time which eventually makes you want to get rid of the passwords. So we saw a bunch of vulnerabilities related to the traditional way of authenticating that is using a username and password. Now, when we talk about authentication, there's basically two aspects which we can use to determine how strong the mechanism is. So it's not just about being very secure, it's also about the convenience for the end user and one of the biggest hassle with the traditional way of authenticating is to maintain and remember complex passwords for multiple accounts. On an average, a person has about 20 to 30 accounts, be it for social media account, finance, e-commerce, et cetera. So what we try to achieve is find a perfect balance between how secure the mechanism is for authenticating a user versus how convenient it is for the end user to actually authenticate to the application or the service. So we can have the most secure of all passwords which is complex, hard to remember, unique, for one, two, maybe five, but as the number grows, managing all these passwords become a hassle. So naturally it made very less sense to have multiple accounts for one user even if they are for different purposes. That's where the concept of a federated identity came into the picture. This is there to make access to multiple services more convenient. Federated identity is basically reusing your authenticated identity to log into different sites. It is one of the most commonly used mechanism in today's world to authenticate to make the process of login to end to multiple applications more convenient. You may not know it, but chances are you are already using this in your daily life. When you visit a new application over the internet, it either asks you to register as a new user or maybe sign in or log in via Facebook, Google, Twitter, etc. So you're basically in this scenario reusing your identities on these platforms to gain access to a new application instead of signing up as a new user. So here in the technical lingo, Google, Facebook or Twitter becomes your identity provider that is providing you an identity and the application you are trying to log into becomes the relying party. The application has outsourced the user authentication step to a trusted IDP or identity provider. The relying party in this case is also known as the service provider because as the name suggests, it is the entity that is providing the services to the end user. So what does it really mean when you say that my authentication is federated out to ABC? In the simplest of terms, instead of the service provider authenticating the user itself, it has offloaded the authentication to another system. The service provider is no longer storing the user credentials or validating them. Instead, the IDP validates the user and notifies the service provider that the user is indeed who they say they are. The service provider here is simply trusting the authentication capabilities of the IDP. So the identity provider is offering user authentication as a service. Now, the beauty of using an IDP is twofold. Firstly, it saves you, the end user, the pain of creating and maintaining multiple passwords for new accounts. And secondly, it spares the third-party application the trouble of storing and protecting that information. In fact, since the authentication process is now relayed to Google or any other trusted identity provider, the third-party website never sees your password or any other authentication credentials. And this single consistent identity being used across platforms, applications, and networks is called a federated identity, which gives birth to the concept of bring your own identity. Now, such a thing is also very common at the enterprise level where a company makes use of several web-based applications within their network and wishes to issue the employee a single set of credentials between the apps. So in this case, here Microsoft's Active Directory, AD, can act as an identity provider.  This basically is referred to as single sign-on, or SSO. The application vendors when they sell their product to various corporate to access, which you might need some credentials. Without the concept of SSO, the employee has to log in to their corporate network, fire up a browser, go to the application URL, and then log in to the application again. So to save this trouble and to provide a more user-friendly flow of things, the IDP validates your credential once and simply grants you access to all the application at your enterprise level based on that. And it is not just convenient for the end user, but also for the IT team. Imagine having to maintain separate accounts for each services, their password resets, and user provisioning or deprovisioning in case some employer leaves the organization. It all seems too much of trouble to deal with, which could be solved using SSO. And of course, there's always this argument of having all the eggs in one basket, but think of it this way. If you're limiting the authentication process to one server, you can basically apply all your expertise into protecting that one server as opposed to having it on different servers maintained by different teams. If you look at the example of Google, even they do a similar thing. When you go to google.com and you click on sign in, you are basically redirected to accounts.google.com.  So in this case, that is one centralized server that is responsible for authenticating you, and once you authenticate it, it redirects you back to the application that you were trying to access. So very quickly, let us look at how the federated authentication works. In this example, we assume the user is using a browser to access the service provider, and the IDP is using an authentication flow using employee redirects. So first, the service provider may have a mechanism of checking if a user is currently authenticated by any session state maintenance. In some cases, the service provider will always redirect to the IDP login page and check the current user state. If the user is not authenticated, they are redirected to the IDP page where they put in the credentials. When you submit your credentials, the IDP validates the credentials and returns back the user to the service provider, if valid. In addition, the IDP creates some signed data to send back along the HTTP request. This data tells the service provider, the user has successfully logged in, among many other things. The service provider now validates the data, and if it is found to be valid, the application can treat the user as authenticated. Now here, one of the most important things in its working is the concept of trust, which is also called the Relying Party Trust, which basically means that the service provider trusts the IDP, and the IDP trusts the service provider to be who it claims to be. This trust relationship is usually managed using different steps of keys, encryptions, or PKI. So Ankit here would explain different protocols related to it. So this is the basic workflow of how things work in a broad expect, keeping out much of the specific details. Specifically, what this data is, how the validation of the data is done, and other important specific security details, which are tied to the implementation. What you should see is that the service provider never dealt with the user's credentials. The validation is done by the IDP and used a secure data format to communicate a successful authentication. This could be a XML, a JOT, et cetera.  Without going into minor details, let us quickly go through some of them. The first one we will be talking about is OWAT, version 2.0. So OWAT is about authorization. That is, I can grant permissions to some website to access my data from another website without actually sharing the user credentials with the original website. So suppose let's take an example of LinkedIn. So when you log into LinkedIn, and LinkedIn wants to import your contacts from your Gmail account. So what it do, it will ask the user that I want to access your Gmail accounts and I want to import it to my account. So it will redirect the user to the Gmail's login page where user enters his or her details about the user and password, and the Gmail is doing the authentication over there. Once the authentication is successful over there, the Gmail ask the user whether the user wants to authorize LinkedIn to access their Gmail contacts or not. And on successful authorization, Gmail redirects back to the LinkedIn saying, hey, hey, LinkedIn, you can now retrieve contacts from Gmail. The user has authorized you to do so. And LinkedIn then imports the contacts from Gmail and tells the user that I have successfully imported the contacts from Gmail. So how OWAT works, it works by delegating user authentication to a service that hosts the user accounts and authorizing third-party applications to access the user account details. OWAT 2 basically provides authorization flow for web and desktop applications and mobile devices. So before moving on, I would like to discuss some of the roles that are in OWAT. The first one is the resource owner. So resource owner is basically the one that is... So basically the one the resource is there for. So the user here is the resource owner. The second one is the authorization server. And from the example, you can link it to like that. The Gmail here is your authorization server, which is authorizing the user that... And authentication and authorizing the user. And the third one is the client, which is the application that wants to access the user details. So in this example, LinkedIn is your client. So before using OWAT with your application, you must do one thing with your application. You need to register your application with the OWAT provider. This is done through a registration form in the developers or API portion of the services website, where you will provide the details about your application and some of the details are. So basically what you are seeing here is an OWAT application registration form for GitHub. So here you need to provide your application name, the name with which you want to register your application. The second one is the application website, which is the homepage URL of your website. And the third one is the redirect or callback URL. So basically this is the URL. The authorization server will be redirecting back after successfully access granted or deny status along with the authorization or the access codes in case of the access is granted. So now we'll look at the flow of the protocol to understand the components involved and how it is actually done. So as you can see in the diagram, the first step is when the user tries to access the client, application using login via some other website for the, let's say, Gmail, Facebook, or Twitter, then the client application first checks whether the user is already logged in or not on the IDP. And in case the user is not logged in in the IDP, then the client application redirects the user to the IDP's login page. The user then enter his or her credentials on the IDP's login page. The IDP verifies the user credentials and on successful verification, the IDP has the user. That this application, the client application, want to access these details of yours, do you want to grant the access or not? And if, suppose if the user says yes, I want to grant permissions to this application to access my details, then the IDP sends the authorization code back to the client application. Now, when the client application wants to access the user details, it needs to send the access code that it gets in the previous step along with the client ID, client secret, and its request to gain access to the user details. Once the IDP receives the access request from the client application, what it does first, it verifies the client and the authorization code that is being set in the sent in the request. And after successful verification of the IDP returns an access token, which is in the form of a jot to the client application. Once the client application gets the access token, it requests the IDP to get the user details. The IDP then verifies the access token if it's a valid access token or not. And if everything is correct, it returns the user details back to the client application. So now we know what OAuth is responsible for and how it is working under the hood, which is it is only responsible for the authorization and delegates the authentication to some other service. What if we don't want to delegate the authentication to some other service and wants to do it on our own? So there are protocols through which you can handle both, i.e. the authentication and the authorization to the resources. And let's have a look at them. The next one that we will be discussing is SAML. So basically, SAML stands for Security Accession Markup Language, which is an XML-based standard for exchanging authentication and authorization data between IDPs and the service providers to verify the user's identity and permissions. And then it grant access or deny the access to the services. SAML grants or deny access by the use of assertions in the XML request response messages that it sends over the HTTP or HTTP S. So basically, there are three types of assertions that we would like to talk about. The first one is the authentication assertion. This proves identification of the user and provides the time the user logged in and what method of authentication they used, i.e. whether they used Kerberos or two-factor, et cetera. The second one is the attribute assertion. They are specific pieces of data that provide information about the user. And the third one is authorization decision assertion. An authorization decision assertion says if the user is authorized to use the service or if the identity provider denied their request due to a password failure or lack of rights to the service. So in spite of being so famous and widely used by various applications, there is one major limitation to this protocol that it is designed only to be used within a web application. This means in order to use SAML with your mobile or desktop applications, you need to do some extra efforts or workarounds to achieve that since SAML is basically all about HTTP redirects, which is hard to handle in a mobile or desktop application. So now, what if we want to achieve SSO in our web mobile or desktop application altogether without putting extra efforts or any workarounds? So there is another protocol that is OIDC, which stands for OpenID Connect, that you can use with any of the application to obtain basic profile information about the end user in an interoperable and REST-like manner. So OIDC is basically made up of two protocols. The first one is OpenID. It is a protocol that is responsible for the authentication mechanism, and the second one is OAuth, which is responsible for the authorization, which we have discussed in the previously. So OIDC is an authentication layer basically on the top of OAuth 2.0, an authorization framework. Like SAML uses the XML for its request-response messages, OIDC uses Jot, which is a JSON web token. For that, OpenID Connect allows clients of all types, including web-based mobile and JavaScript clients, to request and receive information about the authenticated sessions and end users. So since OIDC is a combination of both the protocols, which is OpenID and OAuth, the part till where we get the authorization code is same as in OAuth. The difference here is that the IDP that we are using for the authentication can be our own IDP, basically handling authentications as well, or it can be any other IDPs like Google, Twitter, Facebook. There is one more difference, which is when we are making a request to get the authorization code from the OIDC provider, in OIDC protocol, we need to add the scopes in the request. So basically in the HTTP request that you are making to the IDP, you need to specify what scopes are that you want to use, which is basically added as a query parameter in the request URL. The standard OIDC scopes are, the first one is OpenID, indicates that the application intends to use OIDC to verify the user's identity. The second one is profile, which returns claims that represents basic profile information, like name, family name, given name, et cetera. And the third one is email, which returns the email claims, which contains the user's email address. The first scope that is the OpenID scope is mandatory one. The rest are the optional based on the requirements. Once the client application gets the authorization code, it calls the token endpoint of the OpenID Connect provider to get the ID token and or access token altogether. The access token it gets from the IDP is the same as we get in the OAuth protocol and is used to make subsequent API calls to the OIDC endpoints at the IDP. The ID token is a new thing that was not there in the OAuth and is introduced in the OIDC protocol. So ID token is basically a jot that contains the claims, as we have discussed earlier above, about the authenticated user. The client application can get the user details by decoding this ID token. If the application needs the user details again for some purpose, then it can also directly call the user info endpoint of OpenID Connect provider along with the authorization code received in the first step. So basically that's all for the protocols and how they are actually working at the back end. So Napsh, Ipsha, we'll continue. Ankshankar for explaining in detail how different protocols work. So till here, what we saw was basically the concept of convenience, like not having the user to have or maintain multiple accounts and basically reusing your identity over multiple application services and stuff like that, but with the introduction of this concept of identity, which is federated, there comes one argument against it that now since only one server is maintaining all your authentication, it has to be really secure. So all the talks about the convenience factor of authentication, but with ease and convenience, the need of having more secure authentication is now becoming of utmost importance for the IDP itself. Since now there are a larger number of things at stake here. So how do you make sure that the method that you're using to authenticate a user at the IDP is itself the most secure? The first one very obvious solution is of course to increase the layer in the process of authentication by introducing multi-factor authentication. Multi-factor authentication or MFA creates a multi-layered mechanism that an unauthorized user would have to defeat in order to gain access to a resource. Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. The intent of multi-factor authentication is to provide a higher degree of assurance of the identity of the individual attempting to access a resource. So at the core of MFA, it majorly has a combination of three types of authenticating factors, that is knowledge, possession, and inheritance. So first knowledge, something you know such as password or passphrases. This method involves a verification of information that a user provides, such as password or passphrases, pins, or the answers to secret question, which is basically challenge response. Possession, something you have, such as token, device, or smart card. This method involves verification of a specific item a user has in their possession, such as a physical token, an OTP token, an employee access card, or a phone SIM card. And finally, something you are, such as biometric. This method involves verification of characteristics inherent to the individual, such as wire retina scan, iris scan, fingerprint scans, finger vein scan, facial recognition, hand geometry, and even ear lobe geometry. Other type of information, such as geolocation and time may also be additionally used to authenticate. However, at least two of the three factors mentioned earlier must be used to identify a user. So as you can see, different types of multi-factor authentication may include all these things, SMS voice, OTP, push, physical tokens, biometrics. But one of the most important things here to note is that the authentication mechanism in multi-factor authentication should be independent of one another. Such that the access of one factor does not grant access to any other factor. And the compromise of one factor does not affect the integrity of the other factor. So basically all the factors that you are using to grant access to a user has to be independent of each other. For example, if the same set of credential is used as an authentication factor and also for gaining access to an email account where a secondary factor, say, OTP is sent, these factors are not independent. Similarly, a software certificate stored on your laptop, which is something you have, that is protected by the same set of credentials used to log into the laptop, which is something you know, may not provide independence. If this is not followed, it simply becomes a multi-step authentication as opposed to multi-factor authentication, which is what we must strive to achieve. And indeed adopting multi-factor authentication has shown rewarding results for organizations. Microsoft Research says that you can reduce your odds of being compromised by 99.9% by implementing MFA. It is a reliable mechanism with different great benefits against breaches involving stolen and weak passwords, which is the cause of 81% of hacks around the world. So we kept talking about the two aspects of judging how your authentication mechanism is, the security and the convenience. So if we plot a graph against security and convenience, this is something we get, like coming from the traditional ways of authenticating, which is like just using normal passwords, username and passwords, that is both low on security and convenience. If you add a second factor authentication to password, it slightly becomes higher in terms of security, but then it degrades in convenience because now the user has to go through multiple layers of authentication. So what the IT teams try to deliver is a seamless user experience while balancing the security risk. MFA is a great way to secure your organization, but user often get frustrated with the additional security layer on top of having to remember a password. And that's where the solution of passwordless authentication comes into picture. So passwordless authentication is both high on security and convenience. It not only provides convenient, easy to use and intuitive sign-in user experience, but also reduces helpless costs while meeting the needs of privacy and security. So what exactly is passwordless authentication? In this method, the password is simply removed and replaced with the other two factors of authenticating. That is something you have or something you are. So a very common example of this is biometric authentication, which is among other things now also available to log into Windows 10 device using a biometric gesture like face, recognition, fingerprint, et cetera, similar to the Apple's Face ID or Touch ID. Other examples of passwordless authentication include the push authentication, which basically converts your mobile device into an authenticating token. Again, something that you have locally. So Ipsha mentioned the use of biometrics as a form of password authentication. So let's look into it in more details. So basically biometrics is the most pertinent means of identifying and authenticating individuals in a reliable and very fast through the use of unique biological characteristics. Biometrics allows a person to be identified and authenticated based on a set of recognizable and verifiable data, which are unique and specific to that person. So basically there are two types of biometrics that we have. The first one is the physiological measurements and the second one is the behavioral measurements. So your physiological measurements, these mainly consist of your fingerprints, the shape of your hand or the finger, vein pattern, the eye, iris and retina scan, and the shape of your face, the morphological analysis. And in the behavioral, the most common are your voice recognition, signature dynamics, a speed of movement of pen, acceleration, the pressure exerted, exerted inclination, keystroke dynamics, the way we use objects, gate, the sound of steps, gestures, et cetera. So physiological measurements are usually offering the benefit of remaining more stable throughout the life of an individual. For example, they are not as subject to the effects of stress in contrast to the identification by behavioral measurements. The use of biometrics has many benefits. The leading one is the level of security and accuracy that it guarantees. In contrast to password, badges or documents, biometric data cannot be forgotten, exchanged, stolen or forged. And according to calculations made by Sir Francis Geltow, the probability of finding two similar fingerprints is one in 64 billion, even with the identical twins.  So the first use case is law enforcement and public security, where biometrics can be used to identify criminals, suspects, et cetera. And the second one is in military, where you can use it for enemy and ally identification. The third one is border travel and migration control, where you can use it for the identification of traveler, migrant and passengers. The fourth one is civil identification, which is used for identifying citizens, residents and voter. And so on, you can use it in healthcare and subsidies, physical and commercial applications. So let's talk about the civil identification. So in India, the Adhaar project is by far the world's largest biometric identification system. So Adhaar's number is a 12 digit unique identity tree number issued to all Indian residents on their biographic and biometric data. A photograph, 10 fingerprints, two iris scans. And as of third January 2020, over 1.25 billion people have an Adhaar number, covering more than 99% of the Indian adult population. So how do we use the concept of biometrics in terms of authentication? So biometric authentication is a process of comparing data for the person's characteristic to the person's biometric template to determine resemblance. The reference model is first stored in a database or a secure portable element like a smart card. The data stored is then compared to the person's biometric data to be authenticated. Here it is the person's identity that is being verified. But biometric authentication relies on statistical algorithms. It therefore cannot be 100% reliable when used alone. The technical challenges of automated recognition of individuals based on their biological and behavioral characteristics are inherent to the transformation of analog, which is facial, image, fingerprints, voice patterns through digital informations like patterns that can then be processed, compared, and matched with the effective algorithms. Biometric suffers from the fact that the matching algorithm cannot be compared to the hashes of password, as we said. This means that two biometric measures cannot be compared with each other without them at some point being in plain text in the memory of the device doing the matching. Biometric checks must therefore be carried out on a trusted secure device, which means the alternatives are to have a centralized and supervised server, a trusted biometric device, or a personal security component. Biometric authentication has paved the way to introduce the number of new technologies, for example. So now there are smart ID cards. So numerous national identity cards in different countries like Portugal, Ecuador, South Africa, et cetera, now incorporate digital security features, which are based on the match-on-card fingerprint matching algorithm. Unlike conventional biometric process, the match-on-card algorithm allows fingerprints to be matched locally with a reference frame thanks to the microprocessor built into the biometric ID card and without having to connect to a central biometric database. The second one are the biometric sensor cards. The integration of a fingerprint scanner into smart cards is another form of delivering a safe and convenient way to authenticate people. These biometric sensor cards open up a new dimension in the identification with an ease-to-use, portable, and secure device. They have been launched in 2018 for the first time by the Bank of Cyprus and Gemalto for EVM cards, contactless, and contact payments. They use fingerprint recognition instead of a pin code to authenticate the card holder. The biometric identifiers are checked locally, protected, as they are stored solely on the card, they never leave the card. So that was all for biometrics. Now, while talking about passwordless authentication, we earlier mentioned that how Windows now allow you to log in to your device on Windows 10 using Windows Hello. So Windows Hello is basically a biometric-based technology that enables sign-in mechanism, essentially as an alternative to passwords. This is widely considered more user-friendly, secure, reliable method to access critical devices and services. So very quickly going through what a Windows Hello is, it is safe and secure sign-in mechanism. You can unlock your device using biometric gestures or a pin that is local to a device. And the data is stored locally and never leaves the device. So the biometric data doesn't roam anywhere and is never sent to any external device or server. Because Windows Hello store the biometric identification data on the device, there's no single collection point and attacker can compromise to steal data, as opposed to passwords which are shared secrets, entered and transmitted over network to servers. The intercepted username and password can be used anywhere by anyone since they are stored on the server in case a server breach happens. So authentication secured with a cryptographic key pair is the core concept of Windows Hello. The device creates a public, private key pair when registered. The private key can only be unlocked using a local gesture, such as the biometric or the pin, and then user can sign-in with biometric recognition that's unlocked and secured on the device. So when the identity provider supports key, basically Windows Hello provisioning process creates a crypto key pair which is bound to the TPM, that is the module that is installed in your device. And if it's not there, there are certain other software that can store the key pair. Now access to these keys and obtaining a signature to validate a user possession of the private key is enabled only by the pin or the biometric gesture. The two step that takes place during the Windows Hello enrollment creates a trust between the IDP and the user when the public portion of the key is sent to the IDP associated with the user account. So the server now has a public key that is mapped to the user account during the registration process itself. So then when a user enters a gesture, like a fingerprint or facial recognition on the device, the IDP knows from the combination of the Hello keys and the gesture that this is a verified identity and provides an authentication token that allows user to access resources and services. So as we discussed earlier, push authentication is a way of passwordless authentication. So basically push is a technology that verifies the identity of users by sending a push notification to a mobile device associated with their account during the login process, meaning that there is nothing to remember. All that needs to happen is for the device to be in the hands of the person who owns the account they are trying to access. In a sense, it turns the mobile device into an authentication token. This factor leverages a communication technology originally developed for smartphones, which today is popular in both iOS and Android environments. With this type of authentication, the user accepts or declines transactions, login request, and other operations by pressing a button on a pop-up notification on their smartphone. So basically how it works. So suppose a user wants to access any resource, so it's just a login to that resource and enter his user or her username, and press Enter. Then that application sends a push notification to the mobile device of that user that is being registered previously at the registration part. And when the push notification is sent to the user's mobile device, the user then can accept or deny whether it wants to allow the application to grant access or not. And on successful authentication, not successful authentication, the user is locked into the protected resource. So why we need push? So basically there is no need to memorize and manage passwords. Notification provides a seamless and user-friendly experience. When implemented properly, it is resistant to interception or redirection. That is, it is more secure. So basically if you are doing push authentications, it is very hard to intercept the message and by any hacker that is man in the middle attack. So that's why it is more secure in that manner.  Some were high on security and the others were very convenient for the end user. Some very new technologies are gaining momentum and replacing passwords. Moving from passwords to a stronger mechanism of authentication is indeed the greatest challenge present in today's computing world, but it is imperative in today's time. Since the risk possessed by hacking and breaches a serious and carries a significant real-world impact to businesses and users. The cost now overweighs the benefits of using passwords, predictable and vulnerable. Even though no change is easy and challenges follow as organizations proceed towards adopting password less authentication, the awards related to it are indeed very rewarding. From a technical point of view, the process of reducing and eliminating passwords altogether is the much required change. And as the urgency of making authentication safer and simpler increases, we see more tech come up devices that recognizes voice prints to unique heart rate and trend of wearable computing devices. And we would just like to end this talk by saying that the technology is already there and we just need to start adopting it. Thank you very much.