# HacktBack security contest - Explain SSO/OAuth/OpenID

Sit down, take a breath. You've entered a new life as a letter carrier.

Every morning, you set off on your bike tour, and every day you drop parcels into mailboxes with undersized entrances. Fortunately, your boss has given you the keys to all the mailboxes on your route.

You've been doing this every day for 6 months now, and you're tired of looking for the right key on your 7 sets of 60 keys.

On a Friday evening, you're driving home and pass a bar. Madame isn't in tonight, and you feel like going for a drink for once.

You sit down next to a gentleman and start chatting. He's just been dumped by his wife for spending too much time in his locksmith business.

"But Sir, please understand, I've developed an incredible concept."

He begins to explain how pins work in locks. How, by building different grouping systems, he can give a key to his children so they can open the garage, and he can have a key that can open all the locks in his house.

You know all about keys, and you show him your huge bunch. Then you explain your job. And for the locksmith, it's a revelation: his lifelong quest for a lock system, the loss of his wife, everything led to this point! Better than a match on Tinder, a match of the universe.

The next day you go with the locksmith to meet your boss, who is very interested and asks the locksmith if it would be possible to make master keys for all the mailboxes on a tour. Your boss is very excited to present this revolutionary idea to his management.

Then you'll join the broken-hearted locksmith's company and live happily ever after.

When it comes to IT, you're all letter carriers and women with hundreds of keys.

In the past, each person in a company had several keys.

Now let's define the key in IT terms: it's the identity you use to identify yourself to the IT system. In 99% of cases today, this corresponds to your email/login and password.

When the Internet was created, we didn't have so many keys, except that the more computer systems developed, the more usernames & passwords you had.

This is known as the period of identity chaos. And this represented an astronomical cost for companies, mainly due to forgotten passwords.

Yes, because a forgotten password for a company costs around 40taines of euros at best, but 150/200 euros at worst. Of course, if you calculate the average working day of the people who can't work and the people you have to hire to fix the problem, it starts to get expensive.

Imagine that, multiplied by dozens of applications at the time, that's a lot of forgotten passwords.

Oh no! Back from vacation! €€€

In short, we really needed a locksmith with a broken heart to offer us a solution.

SSO is the creation of this master key and our locksmith's solution.

OAuth means that the letter carrier's rounds will be defined by the letter carrier's boss. In other words, the system that will define which mailboxes you're allowed to open and which you're not.

OpenID Connect is the boss who will hire the letter carriers, i.e. the one who will check the identity of the letter carriers.

I've already exceeded the number of characters for replying in comments, so I'll stop my story here! If you'd like to know the rest, I give online courses at companies, universities and engineering schools to share my passion for cyber security and connected objects!