if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me?
Are they able to steal my contact info, name, etc (assuming I'm using Gmail OpenId)
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
||||
|
|
|
If you authenticate to another website with Google's OpenID system, it will tell them that the person authenticating is in control that particular GMail address. Unless they get in-line between you and another site, they can't perform a MITM attack. They can only effectively take advantage of your credentials if they pretend to be your identity provider and you put your password onto the wrong website. For a comprehensive look at what can go wrong with OpenID, Google says it better than I do: http://sites.google.com/site/openidreview/issues |
|||||
|
|
When you use a google OpenID to sign in to a site (which is thus an OpenID "relying party" or RP), the RP requests various forms of information, and gets it if you agree to provide it. Google tells you what they asked for. So yes, the RP can get contact info, with your permission. But the design of OpenID is intended to protect the most important stuff - your authentication credentials (password or whatever). |
|||
|
|
|
Keep in mind OpenID is a single point of failure. If they where hacked like the RSA Company than all accounts can be compromised. The trade-off is that if you have a problem like sql injection and you only use OpenID, then an attacker would be unable to compromise accounts using this type of vulnerability. |
|||
|
|
