Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

Identity protocols for internet browsers with Sam Goto (Google Chrome) and George Fletcher (Verizon)

## The Overview

In this episode of _Identity, Unlocked_, principal architect at Auth0 and podcast host Vittorio Bertocci speaks with Sam Goto, software engineer working on Google Chrome, and George Fletcher, Identity Standards architect at Verizon, on the ever-changing world of identity protocols for internet browsers.

Sam focuses on working with browsers to create better functionality in their foundation protocol by determining the good and bad uses of low-level primitives, such as third-party cookies, iFrames, and pop-ups. In particular, Sam highlights how such primitives are being used by trackers and ad services to track users, often without their knowledge or consent- and how that is prompting browser vendors to put new limits to prevent abuses. There is a precedent for this: Sam gives the example of how over time, web apps increasingly abused low-level primitives such as pop-ups- and how browsers eventually put restrictions on them to give a better user experience. Browser vendors are now attempting to do the same to prevent unwanted tracking; however, those interventions are disrupting legitimate scenarios too- identity protocols being one of the most important ones, and the very reason we are having this conversation on Identity, Unlocked. Sam then talks about how browsers are looking to fix these problems by building higher level primitives to replace the low-level ones, but that even these high-level primitives face challenges.

George explains the many problems the modifications to browsers can cause for Identity and OpenID Connect. George also goes into detail about the protocols being implemented between browsers, relying on parties and IdPs for what happens if an IdP goes down, as well as the RP classification and decentralized identity.

Vittorio, Sam, and George go in depth on the state of browser changes and identity protocol today and what’s in store for their futures.

## Key Takeaways

Distinguishing between good and bad motives of low level primitives:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/da8f4e71"></iframe>

What’s happening to identity protocols as browser authentication changes:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/7a5f49ee"></iframe>

Sam talks about the potential for other browsers to integrate Web ID and the new challenges that would come about:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/38619c76"></iframe>

George points out key problems to solving the RP classification problem:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/3445437a"></iframe>

George’s Call to Action:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/6baaec0f"></iframe>

Sam’s Call to Action:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/4a98766b"></iframe>


### Links/Resources:

- Connect with Sam Goto on [LinkedIn](https://www.linkedin.com/in/samuelgoto/)
- Connect with Sam Goto on [Twitter](https://twitter.com/samuelgoto)
- Connect with George Fletcher on [LinkedIn](https://www.linkedin.com/in/gffletch/)
- Connect with George Fletcher on [Twitter](https://twitter.com/gffletch)

<br>

- Connect with Vittorio Bertocci on [LinkedIn](https://www.linkedin.com/in/vittoriobertocci/)
- Connect with Vittorio Bertocci on [Twitter](http://www.twitter.com/vibronet)

<br>

- Learn more about [Identity, Unlocked](https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/episodes)
- Learn more about [Auth0](https://auth0.com/)
- Learn more about the sponsor for this season, the [OpenID Foundation](https://openid.net/foundation/)

<include src="asides/IdentityUnlocked" />

<include src="asides/AboutAuth0" />

Identity, Unlocked... Explained: Season 2 Ep 7

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

A new password manager and improved UX lead to quick, safer search.



With updates every six weeks, Google is constantly improving their Chrome browser. But for its ten-year anniversary, Google wanted to give their users a special reason to celebrate. And they delivered with their most recent Chrome update. 

![New UI and features of Google Chrome browser](https://images.ctfassets.net/23aumh6u8s0i/vDmVepxBP7oYXs1FyrsvS/67526580ff6011181a887216df198fbe/google-chrome-a-new-look)

Perhaps you've already peeked at the changes (it launched in early September). But with all of the new details it packs in, even the most up-to-date teams might not have dug in far enough. While some of the updates are undetectable, there are a few more prominent ones that teams using Chrome should understand and employ.

This is a first indication of what is to come in search updates from the giants over at Google. For teams looking to increase productivity — and especially security — we've saved you the trouble of sifting through the details on your own.

<include src="TweetQuote" quoteText="Google is releasing a new Chrome that will improve employee security and productivity."/>

## Chrome's New Password Manager Reduces Chances of Hacking

With a freshly re-imagined password manager, this Chrome update has made it easier for employees to avoid password recycling and improve password storage. This is more important than you might think. According to a recent study, poor passwords are responsible for [81 percent of data breaches](https://www.myndnow.com/news/bismarck-news/poor-passwords-responsible-for-81-of-company-data-breaches/1344822736). Over 70 percent of employees reuse the same password on multiple sites at work — and many of these recycled passwords are easy to hack in the first place. 

Some easily-detectable employee password examples include:

* 123456
* qwerty
* password
* abc123

(The above data is from [Troy Hunt's sample](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/) of more than half a billion passwords that were previously implicated in data breaches.)

The [2012 Dropbox data breach](https://techcrunch.com/2016/08/30/dropbox-employees-password-reuse-led-to-theft-of-60m-user-credentials/), which took the company four years to discover, resulted in the theft of 60 million user credentials due to one employee reusing a password.

Convinced that well-crafted passwords are important? Google agrees.

It has evolved its password-saving function (for easier log-ins and payments) to include a unique password generator along with speedy, more accurate form filling. This is designed to help teams use more diverse and complex passwords.

![Google Chrome's built-in recommended password generator example](https://images.ctfassets.net/23aumh6u8s0i/2XBCoxAqohI63tutNIOafV/15c757387aea7a476090158bb2829143/chrome-built-in-password-generator)

On sites that require passwords, Chrome will suggest hard-to-hack options. One of the most substantial of Chrome's updates, the password manager will save newly created passwords directly to your Google account. Employees can manage them within their accounts or directly in the Chrome toolbar. 

Though password security is crucial, this improvement may seem subtle compared to some of the more eye-popping features in this Chrome update. Let's move onto the new Chrome UI, design, and productivity features.

<include src="TweetQuote" quoteText="The new Chrome now includes a built-in password generator."/>

## A Reimagined Browser Makes Search Faster and Organization Easier

It's clear that Google is focused on making its users more productive. Over and above the rapid generation and storage of passwords, it delivers a valuable interface and design for everyday browsing.

A rounded tab scheme, as opposed to the straight edges in the former version, creates more space to manage web pages and documents across your open tabs. 

![Google Chrome's new UI and rounded design](https://images.ctfassets.net/23aumh6u8s0i/7zhFexF0zeF2HA8mzd6qgT/d89ca63d2a3971466a1aa24358c836e9/chrome-makes-search-faster)

The [improved UX](https://blog.nomnominsights.com/ux-uncensored-what-ux-and-product-people-say-when-nobodys-looking/) allows more space for website icons - the key to differentiating tabs on your browser. Even with fifty tabs open on one window, all fifty icons would be in view. 

You can also search for a specific page in Google's Omnibox - the main hybrid address and search bar. The Omnibox will now tell you if that page is already open, and a click of the new ‘Switch to this tab' option will take you directly there.

Google has already promised an even smarter Omnibox that can search your files from your Google Drive directly. As Chrome evolves, getting yourself to the right page will only continue to get faster and easier.

Employees in the U.S. spend an average of [eight hours a day working](https://www.bls.gov/charts/american-time-use/emp-by-ftpt-job-edu-h.htm) (and this is well below the averages of many high-performance roles in industries like finance and law). [Increasing employee productivity](http://blog.idonethis.com/productivity-software/) is critical to keeping teams on track and competitive, even if that means shaving off seconds with improved browser organization and search functions. These will add up over time, freeing up team members to dig into the most valuable tasks.

### It's not all about desktop: Chrome includes mobile browsing updates

Mobile search has also drastically improved, thanks to Google's careful consideration of one-handed, on-the-go features. 

![Chrome mobile browser updates](https://images.ctfassets.net/23aumh6u8s0i/4rg6oIKMw8sGkldmrucn2k/50bbd13bf308a0a0097c4021c4d3adc1/new-chrome-on-mobile-as-well)

Searching with one hand becomes exceedingly more convenient when you don't have to reach the top of the screen. The keyboard appears simply by clicking the new search button at thumb's length.

Google also makes it easier to jump between tabs on your phone by keeping the tab count next to the bottom search button. 

Click through to open tabs and you'll see the same rounded redesign from the desktop version on both iOS and Android. With a full view of each open page, the new look helps make your mobile tabs even more intuitive than on your desktop. Plus, this look matches up with the new Google Drive on your desktop, giving an even more cohesive feel to the whole Google family. 

In 2017, [49.7 percent](https://www.statista.com/topics/779/mobile-internet/) of web page views worldwide were on mobile devices — and mobile data traffic is projected to increase 7X by 2021. As more employees work remotely, travel, and rely on mobile devices, these small tweaks that Chrome has rolled out for iOS will make a difference.

## The Future of Search: What's Ahead For Teams That Use Chrome

Today, Chrome is the most heavily used browser, with over 60 percent of users relying on it.

![Statistics - Chrome is the most widely used browser in the world](https://images.ctfassets.net/23aumh6u8s0i/6Dw9jygFbyGYswOASX3Gks/f67b16dd6b64ad92d5949e57e9fc4644/browsers-usage-comparison)

The changes that Google makes will have far-reaching consequences for employee security and agility at work, helping everyone brace themselves in an [increasingly complex threat environment](https://auth0.com/blog/3-critical-lessons-from-the-t-mobile-data-breach/). 

While this Chrome update has provided the internet with a new look, tighter security, and more productive tabs, the real excitement comes in a reimagined future for upcoming Chrome models. 

With rumors of a [_URL-less browser_](https://www.digitaltrends.com/web/google-wants-to-kill-urls-to-make-the-internet-safer/) for safer browsing and further implementation of artificial intelligence, there's a lot in store that's bound to make life increasingly more efficient. 

Google has also indicated more "under the hood" security updates in 2018, including an improved ad filter to [_site isolation_](https://security.googleblog.com/2018/07/mitigating-spectre-with-site-isolation.html).

Lastly, Google also gave us a first glimpse into smart search bar answers—a convenient way to get answers to straightforward questions. For example, when you search for the weather, Chrome will give you the answer directly into the search bar - rather than taking you to a search engine page first.

![Chrome Omnibox search features include giving you answers directly in the search bar](https://images.ctfassets.net/23aumh6u8s0i/4vMgV5Hlxjsl3Poo171YNz/acbca889e63916c5ef09fcab2ccf245c/new-features-on-google-chrome)

With a deliberate focus on simple questions, this feature is designed for the moments when all you need is a quick explanation or an immediate reminder on a piece of trivia or even a language translation. 

As the Omnibox becomes increasingly smarter, the future of search is rapidly unfurling before our eyes. Google intends to continually improve how users find information—and keep it safe—in 2018 and beyond.

<include src="TweetQuote" quoteText="Chrome, the most popular browser in the world has a new version with a lot of great features.."/>

<include src="asides/AboutAuth0" />


New Chrome Improves Employee Security and Productivity

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Check out our summary of the Chrome Developer Summit 2017, Day 2.

Chrome Developer Summit 2017 Summary - Day 2

Check out our summary of the Chrome Developer Summit 2017, Day 1.

Chrome Developer Summit 2017 Summary - Day 1

Check out our summary of the recently concluded Chrome Developer Summit.

Chrome Developer Summit 2016 - Summary

bc94ff6211e645a2bdb4fdc60e23ad85

Kassandra Perch

We've created a video showing of some of the cool features of our JWT Debugger for you to see


<include src="Vidyard" id="d8j9Txpk2R5pPLhbtGFFau" />

## Transcript

Hi, this is Kassandra with Auth0, and today we're gonna talk about the new JWT plugin that we've launched. So I've already installed it, and you can see the logo over here, and so I'm gonna click on it. And you can see the debugger. Now, there are quite a few features that are brand-new to this debugger that I want to show you. One of the first ones is this "Open JWT From." So what I'm gonna do is, it says, "Web Storage" and "Cookies," so I'm actually going to use the local storage API to save a JWT into local storage and show you how you can debug it.

Okay, now to do that, what I'm going to do is say, "localStorage.setItem()" with our token. Okay. So now I'm going to reopen the JWT debugger and go to Open JWT From. And as you can see, my token now shows up here. Now it does still say invalid signature, so I'm gonna have to change the secret to the secret I made this key with, and you can now see signature verified, just like with the JWT debugger on the webpage. You can also share JWTs with this button. You copy the URL, and it will send people to the debugger on the website.

One of the other really cool things you can do with the JWT plugin is decode and check RSA signed JWTs. And so I've pasted one in here, and as you can see, it wants my public and private key. I'm gonna put in my public key here, and I'm gonna take my private key off there. And I'm gonna put that here. And as you can see, the signature is now verified. This can come in handy in many, many situations. So basically if you're working on a site using JWTs, you can now pull those JWTs from local storage or cookies, and no matter what you used to encode them, be it a public, private key pair or an HS256 secret, you can debug them in your browser without even having to leave.

Hopefully this will inspire you to [download the debugger yourself](https://chrome.google.com/webstore/detail/jwt-debugger/ppmmlchacdbknfphdeafcbmklcghghmd?hl=en). I'm Kassandra Perch with Auth0. Thanks for watching.


Learn more about the new JWT Debugger Chrome Extension

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Do you like JWT.io? Then you'll love this extension!



Do you find yourself visiting [JWT.io](https://jwt.io) a lot to debug your tokens? Then you'll love what we have in store for you: [JWT.io as a Chrome extension](https://chrome.google.com/webstore/detail/jwt-debugger/ppmmlchacdbknfphdeafcbmklcghghmd) with extra features!

<include src="TweetQuote" quoteText="Debug JWTs from your browser with our new extension: https://goo.gl/axNsXn"/>

-----

## A New Chrome Extension
We noticed many users rely on [JWT.io](https://jwt.io) to debug their JWTs. And with good reason! The colored visual editor is intuitive and has support for both HMAC and RSA signed JWTs. So we thought: what if we made this available offline for all users with a few extra features? So our [new Chrome extension](https://chrome.google.com/webstore/detail/jwt-debugger/ppmmlchacdbknfphdeafcbmklcghghmd) was born.

## Features
- Visual JWT editor with coloring:
![JWT Debugger](https://images.ctfassets.net/23aumh6u8s0i/6kNIm4984TkoHc56HSWpw4/12e31ed46fb4001384321f0624273634/editor)

- Support for HS256 (HMAC + SHA256) signed JWTs:
![JWT Debugger HS256 support](https://images.ctfassets.net/23aumh6u8s0i/7HtwQ0sZRJpQzXI8GNIC77/be00c8f35eedbe242c7849cba440e5d2/hs256-2)

- Support for RS256 (RSA) signed JWTs:
![JWT Debugger RS256 support](https://images.ctfassets.net/23aumh6u8s0i/BHrWz3ctLpLumgRPozIUM/7cac276fedfd8956e02c49fc465c16ea/rs256-2)

- Load and save JWTs in cookies and web storage from the current tab:
![JWT Debugger load from cookies/web storage](https://images.ctfassets.net/23aumh6u8s0i/33ZIvbcX2GIIGo3aZbzkaC/c0ae9508862cd211898db57eb8023d0a/load-from)

- Get a shareable URL for your JWTs:
![JWT Debugger shareable URL](https://images.ctfassets.net/23aumh6u8s0i/4Gp39AxqZH41lM9XxOzkjU/af9f4bb9d589ff2100ad78a5f477421e/share-2)

[Try it out now](https://chrome.google.com/webstore/detail/jwt-debugger/ppmmlchacdbknfphdeafcbmklcghghmd) and give us your feedback! Can you think of any other features you'd love to have? Tell us below in the comments or through Chrome's Web Store.

<include src="asides/Jwt" />


"Chrome"