Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
1

OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers.

What are the security challenges that these services face?

share|improve this question
This sounds like a homework essay rather than a question for a Q&A forum like this one. You think you could winnow this down a bit to something more specific? – tylerl Sep 27 '12 at 0:16
You're right, thanks for the comment. I've reduced the scope of this one and added a new one here, security.stackexchange.com/questions/20746/…. – Daniel Sep 27 '12 at 0:49
It still feels a little too broad to me. StackExchange as a whole has a preference for strictly answerable questions, whereas this seems like any number of questions could be correct. – Scott Pack Sep 27 '12 at 3:00
I'm open to suggestions. I noticed there wasn't much discussion of attribute exchange on here so I wanted to kick things off :-) – Daniel Sep 27 '12 at 5:21

1 Answer

up vote 1 down vote

At the end of the day the client (usually a browser) still needs a token to maintain a session (usually with a cookie variable). If the attacker gets this token, by XSS or OWASP A9 then they can access the same resources. CSRF is also a concern.

Now this is assuming that these authentication providers are totally immune from attack. If a flaw exists in one of these services, you are also in trouble. SQL Injection, Phishing, Insecure backups, lack of brute force protection are just a few concerns.

oauzz is an oauth fuzzer, which can uncover serious flaws in an oauth implementation.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.