OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers.

What are the security challenges that these services face?

  • This sounds like a homework essay rather than a question for a Q&A forum like this one. You think you could winnow this down a bit to something more specific? – tylerl Sep 27 '12 at 0:16
  • You're right, thanks for the comment. I've reduced the scope of this one and added a new one here, security.stackexchange.com/questions/20746/…. – Daniel Sep 27 '12 at 0:49
  • It still feels a little too broad to me. StackExchange as a whole has a preference for strictly answerable questions, whereas this seems like any number of questions could be correct. – Scott Pack Sep 27 '12 at 3:00
  • I'm open to suggestions. I noticed there wasn't much discussion of attribute exchange on here so I wanted to kick things off :-) – Daniel Sep 27 '12 at 5:21

At the end of the day the client (usually a browser) still needs a token to maintain a session (usually with a cookie variable). If the attacker gets this token, by XSS or OWASP A9 then they can access the same resources. CSRF is also a concern.

Now this is assuming that these authentication providers are totally immune from attack. If a flaw exists in one of these services, you are also in trouble. SQL Injection, Phishing, Insecure backups, lack of brute force protection are just a few concerns.

oauzz is an oauth fuzzer, which can uncover serious flaws in an oauth implementation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.