0
votes
3answers
77 views

Can I trust profile data a 3rd party auth provider send to me?

This question may be related to this one, but I think we need to be sure. My website implement login via OpenID (or Google, or Facebook, etc.). On my website, authorization is based on user email ...
1
vote
2answers
299 views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
3
votes
1answer
2k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
1
vote
2answers
103 views

Verify a user's affiliation with an organization

I'm in charge of IT at a students' organization. Let's call it FratA. FratA has ties to sister-organizations in other university cities in my country. Let's call those FratB through FratZ. These ...
0
votes
1answer
455 views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
2
votes
1answer
168 views

API authentication without Oauth2 server

I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login ...
1
vote
1answer
68 views

Should Framebusting be used (not used) on an IdP login page?

I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary. On the other hand, if I ...
5
votes
1answer
335 views

Are there risks of using the same OpenID provider for sites with different security levels?

I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
0
votes
2answers
376 views

OpenID without SSL certificate

Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed? Just to make things clear, ...
1
vote
3answers
248 views

Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?

Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP. Should banks offer integration with services like OpenID, WS-Fed, or ...
6
votes
4answers
313 views

Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?

First, I have a private delegate set up on my web site for OpenID and pointed my SE account at the URL on my web site; SE has no knowledge of the actual OpenID provider endpoint until my delegate ...
0
votes
1answer
54 views

Considerations when displaying OpenID and WS-* output to an end user

I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure. I would like to create a page that decryption the current session's OpenID or WS-* token, ...
3
votes
1answer
562 views

Are there any anonymous OpenID providers similar to Gawker's “burner”?

Gwaker has an anonymous commenting system called Burner. It is offered as an alternative to Facebook, Twitter and Google. What's the difference between Burner and creating a throwaway Google , ...
1
vote
2answers
87 views

How are 2 Open IDs linked on StackExchange?

I have an account with Google & Facebook. Login IDs for them both are same (same gmail id). When logging into StackOverflow using either of Google or Facebook logins would link to same account. ...
1
vote
1answer
317 views

What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?

I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
4
votes
2answers
613 views

Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
35
votes
5answers
6k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
5
votes
2answers
1k views

How does openid implement Single sign on?

I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
35
votes
9answers
2k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
14
votes
3answers
208 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
15
votes
6answers
912 views

Appropriate password requirements for a login (OpenID) service/provider/delegate/thing

This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case ...
5
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...
9
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...
18
votes
3answers
368 views

Isn't openid with http an issue?

Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com). Does this pose a threat beside the identity being exposed? The second step of ...
22
votes
4answers
542 views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...