Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me?

Are they able to steal my contact info, name, etc (assuming I'm using Gmail OpenId)

share|improve this question

4 Answers 4

up vote 8 down vote accepted

If you authenticate to another website with Google's OpenID system, it will tell them that the person authenticating is in control that particular GMail address. Unless they get in-line between you and another site, they can't perform a MITM attack. They can only effectively take advantage of your credentials if they pretend to be your identity provider and you put your password onto the wrong website.

For a comprehensive look at what can go wrong with OpenID, Google says it better than I do: http://sites.google.com/site/openidreview/issues

share|improve this answer
3  
The link you give is to a site hosted by Google but the content is not from them. It seems related to some IIW OpenID meeting. –  nealmcb May 20 '11 at 3:49

When you use a google OpenID to sign in to a site (which is thus an OpenID "relying party" or RP), the RP requests various forms of information, and gets it if you agree to provide it. Google tells you what they asked for. So yes, the RP can get contact info, with your permission.

But the design of OpenID is intended to protect the most important stuff - your authentication credentials (password or whatever).

share|improve this answer

Keep in mind OpenID is a single point of failure. If they were hacked like the RSA Company then all accounts can be compromised. The trade-off is that if you have a problem like SQL injection and you only use OpenID, then an attacker would be unable to compromise accounts using this type of vulnerability.

share|improve this answer
    
If they were hacked ... who? OpenID is a technology, not somebody. –  Alois Mahdal Jun 24 at 13:37

Not exactly answering the question, but it's good to realize that by registering with OpenID, you are still entrusting the relaying party with your personal data, and in many cases they will want to store it. So it's up to them if they protect the data from being harvested.

For example, recently I found out that an e-shop where I registered using OpenID, my email, real address, phone no, purchase history... was "protected" by 5-digit password, stored unhashed in the database.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.