9
votes
1answer
451 views

Is logging in using OAuth/OpenID also vulnerable to heartbleed?

If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
2
votes
1answer
161 views

Google Open ID connect and ID token

I am wondering if it is safe to send "id token", which is one of the items that are result of authenticating a user using Google Open Id Connect, to the client and use it for further authentication. ...
7
votes
2answers
231 views

How does an attacker abuse Facebook Connect with a leaked secret key?

I am reading about Facebook Connect and it looks a lot like OpenID Connect. Are these two similar enough that the Facebook Connect secret key is an OAuth Client Secret and therefore the same attacks ...
1
vote
2answers
320 views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
3
votes
1answer
2k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
3
votes
1answer
485 views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
5
votes
1answer
91 views

If a service that I registered with FB/Twitter/G+ is hacked, what mischief can be done with the oauth token?

Case in point, TrueCaller. I had logged into TC using a proxy twitter account. I am assuming that as part of the authentication process, an access_token must have been saved by TC. If the hackers ...
2
votes
1answer
169 views

API authentication without Oauth2 server

I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login ...
5
votes
1answer
70 views

What are the security challenges encountered with attribute exchange?

OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers. What are the ...
4
votes
2answers
617 views

Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
15
votes
2answers
1k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
35
votes
5answers
6k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
35
votes
9answers
3k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
9
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...