Tagged Questions
1
vote
1answer
44 views
Should Framebusting be used (not used) on an IdP login page?
I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.
On the other hand, if I ...
5
votes
1answer
83 views
Are there risks of using the same OpenID provider for sites with different security levels?
I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
0
votes
2answers
114 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
1
vote
3answers
142 views
Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?
Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP.
Should banks offer integration with services like OpenID, WS-Fed, or ...
2
votes
4answers
191 views
Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
First, I have a private delegate set up on my web site for OpenID and pointed my SE account at the URL on my web site; SE has no knowledge of the actual OpenID provider endpoint until my delegate ...
0
votes
1answer
45 views
Considerations when displaying OpenID and WS-* output to an end user
I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure.
I would like to create a page that decryption the current session's OpenID or WS-* token, ...
2
votes
1answer
314 views
Are there any anonymous OpenID providers similar to Gawker's “burner”?
Gwaker has an anonymous commenting system called Burner. It is offered as an alternative to Facebook, Twitter and Google.
What's the difference between Burner and creating a throwaway Google , ...
1
vote
2answers
80 views
How are 2 Open IDs linked on StackExchange?
I have an account with Google & Facebook. Login IDs for them both are same (same gmail id).
When logging into StackOverflow using either of Google or Facebook logins would link to same account.
...
1
vote
1answer
185 views
What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?
I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
4
votes
1answer
431 views
Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?
I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
30
votes
5answers
5k views
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage ...
5
votes
2answers
688 views
How does openid implement Single sign on?
I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
26
votes
9answers
2k views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
13
votes
3answers
179 views
Are malicious relying parties able to abuse OpenID logins?
if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me?
Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
13
votes
6answers
675 views
Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements).
Currently, password requirements are:
Must contain 3 of: lower case ...
3
votes
3answers
1k views
What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?
I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional.
My intent is to gracefully ...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
18
votes
3answers
342 views
Isn't openid with http an issue?
Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com).
Does this pose a threat beside the identity being exposed? The second step of ...
18
votes
4answers
425 views
How does using OpenID affect webapp security?
Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use.
But what are the security considerations one should bear in mind when deciding whether to ...
