An open Single Sign On (SSO) solution for the web, a problem also addressed by SAML.
1
vote
0answers
23 views
How to handle two sets of OpenID credentials providing the same information, on the same or different OpenID providers?
I recently encountered a situation where one site assumed that if two different people's credentials for the same OpenID network produce the same email address then they were they same person. Also, ...
1
vote
1answer
43 views
Should Framebusting be used (not used) on an IdP login page?
I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.
On the other hand, if I ...
5
votes
1answer
82 views
Are there risks of using the same OpenID provider for sites with different security levels?
I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
0
votes
2answers
114 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
1
vote
3answers
142 views
Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?
Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP.
Should banks offer integration with services like OpenID, WS-Fed, or ...
1
vote
1answer
46 views
How can I use many LiveIDs (or Microsoft Accounts) at the same time? [closed]
I use several sites under a different "LiveID" / Microsoft Account and need to use the following under different identities
Windows Azure Management Portal
Outlook.com
MSDN Forums / Technet
...
0
votes
0answers
39 views
What attribute exchange services are available? [closed]
As Identity systems become more popular across the internet there will be increasing benefits from binding a user's personal information to their digital identity. The ability to exchange these ...
5
votes
1answer
56 views
What are the security challenges encountered with attribute exchange?
OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers.
What are the ...
3
votes
1answer
95 views
What are the benefits of federated identity management over bare bones public key encryption?
What are the main reasons for having a federated identity system such as OpenID over having identities based purely on a public key?
OpenID uses an Identity Provider to confirm that a user owns a ...
5
votes
1answer
185 views
Open ID, Storing card details, and PCI compliance
If you store payment card details for a user, and you have a 'Login via openID' which includes services like Google and Facebook, is this allowed under PCI Compliance? Or do you need your own distinct ...
2
votes
4answers
190 views
Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
First, I have a private delegate set up on my web site for OpenID and pointed my SE account at the URL on my web site; SE has no knowledge of the actual OpenID provider endpoint until my delegate ...
1
vote
1answer
79 views
How does openid signature work without a shared key
Following is my understanding - A third party app redirects to a an OP for authentication. Once the authentication is complete the OP redirects back to the third party app.
It also sends back in ...
0
votes
1answer
45 views
Considerations when displaying OpenID and WS-* output to an end user
I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure.
I would like to create a page that decryption the current session's OpenID or WS-* token, ...
2
votes
1answer
313 views
Are there any anonymous OpenID providers similar to Gawker's “burner”?
Gwaker has an anonymous commenting system called Burner. It is offered as an alternative to Facebook, Twitter and Google.
What's the difference between Burner and creating a throwaway Google , ...
1
vote
2answers
80 views
How are 2 Open IDs linked on StackExchange?
I have an account with Google & Facebook. Login IDs for them both are same (same gmail id).
When logging into StackOverflow using either of Google or Facebook logins would link to same account.
...
3
votes
1answer
252 views
OpenID Session Fixation with CSRF
This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
10
votes
1answer
382 views
What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?
It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
1
vote
1answer
185 views
What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?
I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
4
votes
1answer
431 views
Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?
I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
13
votes
2answers
752 views
Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
It's clear there there is no consistent set of features among any of the popular authentication providers.
Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
14
votes
1answer
937 views
Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
30
votes
5answers
4k views
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage ...
5
votes
2answers
688 views
How does openid implement Single sign on?
I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
26
votes
9answers
2k views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
13
votes
3answers
179 views
Are malicious relying parties able to abuse OpenID logins?
if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me?
Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
13
votes
6answers
674 views
Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements).
Currently, password requirements are:
Must contain 3 of: lower case ...
3
votes
3answers
1k views
What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?
I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional.
My intent is to gracefully ...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
18
votes
3answers
342 views
Isn't openid with http an issue?
Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com).
Does this pose a threat beside the identity being exposed? The second step of ...
18
votes
4answers
425 views
How does using OpenID affect webapp security?
Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use.
But what are the security considerations one should bear in mind when deciding whether to ...
