1

OpenID Connect defines a special use case for self-issued.me and it's registered overseas to what I assume is a fictional name.

What is the risk of someone owning this domain w.r.t. OpenID Connect?

self-issued.me
Domain Name: SELF-ISSUED.ME
Registry Domain ID: D108500000002096888-AGRS
Registrar WHOIS Server:
Registrar URL: http://www.tucows.com
Updated Date: 2016-06-26T04:02:26Z
Creation Date: 2011-07-25T15:57:46Z
Registry Expiry Date: 2017-07-25T15:57:46Z
Registrar: Tucows Domains Inc.
Registrar IANA ID: 69
Registrar Abuse Contact Email:
Registrar Abuse Contact Phone:
Domain Status: ok https://icann.org/epp#ok
Registry Registrant ID: tuzK33SBHcrUhtLa
Registrant Name: John Bradley
Registrant Organization:
Registrant Street: Casilla 177
Registrant Street: Sucursal Talagante
Registrant City: Talagante
Registrant State/Province: Santiago RM
Registrant Postal Code: 9670447
Registrant Country: CL
Registrant Phone: +56.28559161
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: jbradley@mac.com
Registry Admin ID: tubOb46ov59QzL0V
Admin Name: John Bradley
Admin Organization:
Admin Street: Casilla 177
Admin Street: Sucursal Talagante
Admin City: Talagante
Admin State/Province: Santiago RM
Admin Postal Code: 9670447
Admin Country: CL
Admin Phone: +56.28559161
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: jbradley@mac.com
Registry Tech ID: tuXVh6iHDxmY8Tcn
Tech Name: John Bradley
Tech Organization:
Tech Street: Casilla 177
Tech Street: Sucursal Talagante
Tech City: Talagante
Tech State/Province: Santiago RM
Tech Postal Code: 9670447
Tech Country: CL
Tech Phone: +56.28559161
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: jbradley@mac.com
Name Server: NS1.SYSTEMDNS.COM
Name Server: NS2.SYSTEMDNS.COM
Name Server: NS3.SYSTEMDNS.COM
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of WHOIS database: 2017-02-07T21:08:10Z 

2 Answers 2

1

According to https://openid.net/foundation/leadership/, John Bradley is the OpenID Foundation's Treasurer.

John Bradley

Treasurer

Ping Identity

Mr. Bradley is an Identity Management subject matter expert and IT professional with a diverse background. Mr. Bradley has over 15 years experience in the information technology and identity management field. Mr. Bradley advises Government Agencies and commercial organizations on the policy and technical requirements of Identity Management, Federated Identity, PKI and smart card solutions. Mr. Bradley communicates effectively with clients, vendors, staff and standards organizations to brief them on complex state-of-the-art identity management concepts, best practices, and technical requirements. He is also Chair of the Federation Interoperability WG at Kantara. He is treasurer of the openID Foundation, on the advisory board for OIX, and an active contributor to SAML and other OASIS specifications at OASIS. . Mr. Bradley is one of the leaders of OSIS, and the Kantara Interoperability Review Board, forums that vendors use for industry interoperability testing, and thus has an in-depth understanding not only of the factors that contribute to success, but of upcoming trends that affect whether strategic planning will ensure optimal effectiveness for future operability. Recently John has been co-authoring the ICAM protocol profiles at Protiviti Government Services on behalf of GSA, and continues to support the FICAM interoperability Lab. Current projects include co-authoring the next version of the openID specification and related standards.

You also see John's name as one of the author of the OpenID standard.

There is a LinkedIn page that indicates that John Bradley's does live in Chile (CL).

So the name does not appear to be fictional. Whether the registration detail is forged by a third party pretending to be John though, it's probably hard to tell unless you contact John directly. However, the email address used in the registration (jbradley@mac.com) does match the email address used by John on his OpenID works, as mentioned in http://wiki.openid.net/w/page/12995215/OpenID%20Authentication%202-1, and many of his email correspondences on public mailing lists.

In terms of security, any good implementation of OpenID should not trust unrecognized issuers, and self-issued identity and https://self-issued.me should both be considered unrecognized issuer by default. Anyone can be an OpenID issuer, not everyone should be in the list of trusted issuer for your applications. A rogue having control of https://self-issued.me shouldn't risk the security of libraries that doesn't special case https://self-issued.me, as long as the library has not been misconfigured to trust https://self-issued.me.

0

Yes the domain self-issued.me was registered by John Bradley and is controlled by the openID Foundation. Mr Bradley is only considered fictional by his family if he travels too much.

The .well-known discovery info should be hardcoded into clients and not dynamically discovered.

The domain was a bit of a hack to allow a regular RP that supported dynamic discovery to use a Self Issued OP. To my knowledge there are no real world implementations of Connect dynamic discovery using web-finger however.

Sorry for the late reply, but I just came across this. You could have just emailed me or the foundation for an explanation.

Regards John B.

PS Chile is not overseas if you are in the Americas. We all need to live someplace.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.