5

OpenID has Attribute Exchange, Facebook has Facebook Connect, and authorization services such as Oauth enable access to user data distributed across a range of content providers.

What are the security challenges that these services face?

4
  • This sounds like a homework essay rather than a question for a Q&A forum like this one. You think you could winnow this down a bit to something more specific?
    – tylerl
    Sep 27, 2012 at 0:16
  • You're right, thanks for the comment. I've reduced the scope of this one and added a new one here, security.stackexchange.com/questions/20746/….
    – Daniel
    Sep 27, 2012 at 0:49
  • It still feels a little too broad to me. StackExchange as a whole has a preference for strictly answerable questions, whereas this seems like any number of questions could be correct.
    – Scott Pack
    Sep 27, 2012 at 3:00
  • I'm open to suggestions. I noticed there wasn't much discussion of attribute exchange on here so I wanted to kick things off :-)
    – Daniel
    Sep 27, 2012 at 5:21

1 Answer 1

1

At the end of the day the client (usually a browser) still needs a token to maintain a session (usually with a cookie variable). If the attacker gets this token, by XSS or OWASP A9 then they can access the same resources. CSRF is also a concern.

Now this is assuming that these authentication providers are totally immune from attack. If a flaw exists in one of these services, you are also in trouble. SQL Injection, Phishing, Insecure backups, lack of brute force protection are just a few concerns.

oauzz is an oauth fuzzer, which can uncover serious flaws in an oauth implementation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .