Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?

share|improve this question

1 Answer 1

up vote 10 down vote accepted

OAuth and OpenID don't send your password to the sites you use OAuth/OpenID providers to login with, so no. Not unless the attack is performed on the OAuth/OpenID provider and provider's servers are vulnerable to CVE-2014-0160 (The Heartbleed Bug). It is however possible, of course provided that sites you're logging into using OAuth/OpenID providers are vulnerable to Heartbleed, that other information could leak, like say your email address, or user session information with which it could be hijacked for the duration that it is valid for.

share|improve this answer
    
But OAuth (for example) sends your authentication tokens. Aren't those tokens themselves vulnerable to hijack? –  Graham Borland Apr 11 at 8:47
1  
@GrahamBorland Yes, I say that already in my answer. The tokens are nonces, so they're unique and used only once per session authorisation, but the same user session that the nonce is leaked could potentially be hijacked, if they're used before they expire. To thwart against that however doesn't require (in this case, like OP describes) change of password, signing out and logging back in with the same OAuth/OpenID providers would generate new session nonces. Tho it might be pointless, because those nonces are usually valid only for a very short time. It would depend on the provider though. ;) –  TildalWave Apr 11 at 12:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.