Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

First, I have a private delegate set up on my web site for OpenID and pointed my SE account at the URL on my web site; SE has no knowledge of the actual OpenID provider endpoint until my delegate response tells it.

Second, when authenticating to SE et al I note that if I don't explicitly key in https://... it makes the request using HTTP instead of HTTPS.

Third, having associated my SE account with my OpenID endpoint, I am able to use either HTTP or HTTPS to login, despite using HTTPS when the account was associated.

Does this not, therefore, open me up to a MITM attack whereby the attacker simply modifies the response from my web server to delegate to their own OpenID provider, thereby gaining access to my SE account?

Note: I am not talking about the actual authentication step with the OpenID provider, which does use HTTPS and redirects to HTTPS if accessed via HTTP, I am talking about the initial request from SE to my delegate, which SE allows to be done using HTTP because they only store the URL from the base domain onwards (omitting both the protocol and the sub-domain) to use for matching up to an account instead of the full URL.

share|improve this question
add comment

4 Answers 4

up vote 5 down vote accepted

Yes, it is. So you should always use https.

Even worse, some service providers violate the specification:

11.5.2. HTTP and HTTPS URL Identifiers

Relying Parties MUST differentiate between URL Identifiers that have different schemes.

Any consumer/service provider which violates this rule, is vulnerable to an attack. This is especially bad because a user cannot protect himself: He may use https every single time, but the attacker can just use http.

Furthermore a man in the middle vector is not required. It is sufficient for the attacker to be able to read the traffic to the identity provider; at a time of his choice.

When end user input is processed into a URL, it is processed into a HTTP URL.

So the behavior of StackExchange is in compliance as far as defaulting to http is concerned.

The specification continues:

[...] it is RECOMMENDED that a redirect be issued from the HTTP URL to the HTTPS URL. Because the HTTP and HTTPS URLs are not equivalent and the Identifier that is used is the URL after following redirects, there is no foreseen reduction in security when using this scheme.

If an attacker could gain control of the HTTP URL, it would have no effect on the HTTPS URL, since the HTTP URL is not ever used as an Identifier except to initiate the discovery process.

Note: This approach is still vulnerable on the very first discovery process.

Specification: http://openid.net/specs/openid-authentication-2_0.html#anchor45

share|improve this answer
2  
And StackExchange would appear to be just such a relying party violating the spec, since it appears to let me log in with either HTTP or HTTPS regardless of which scheme is used to create the association. –  Lawrence Dol Aug 13 '12 at 20:10
add comment

The problem with this is that each login initiates the new HTTPS request, which is very slow. It is absolutely very slow. But if done right with HTTP/1.1 with keep-alive connection persistence, it's not, so it's just pure laziness of the developers... "who needs ssl for authentication"? :-)

share|improve this answer
add comment

What is the delegate URL you use? HTTP or HTTPS?

When you click on the OpenID provider for Google or any of the preconfigured OpenID sites, you are redirected to a HTTPS site.

Only one OpenID provider I know of deals with this scenario wonderfuly: Symantec Verisign PiP Labs. Once you log in you have the option to DENY all initial authentication created by a redirect. Instead, they ask that you login directly to pip.verisignlabs.com and then navigate to Stackoverflow and login.

share|improve this answer
    
The delegate can be accessed by both HTTP and HTTPS; I logged the SO login and it requested it with HTTP. –  Lawrence Dol Aug 10 '12 at 21:56
    
And when I removed the mapping for the document via HTTP attempting to login fails, saying the OpenID endpoint could not be found. –  Lawrence Dol Aug 10 '12 at 22:07
    
Ahhh. I found out that if I explicitly specify https://mywebsite.com... it does use HTTPS. –  Lawrence Dol Aug 10 '12 at 23:09
    
But the fact that I only serve the delegate response from HTTPS does not stop an attacker intercepting an HTTP request for it and faking the response to redirect to their choice of OpenID provider. –  Lawrence Dol Jan 19 '13 at 21:36
add comment

Yes. I suspect that anyone who could MITM StackExchange <-> your website (which may, e.g., have a self-signed cert) would be able to insert an alternative OpenID delegate (into the index.html) and use that to break into your StackExchange account.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.