I recently encountered a situation where one site assumed that if two different people's credentials for the same OpenID network produce the same email address then they were they same person. Also, less recently I encountered a situation where one site assumed that if two different OpenID providers produce the same email address then they are the same person.

Both of these seem like security concerns to me. Just because Facebook thinks my email address is root@army.mil does not mean that you should give me access to root@army.mil's account on your site.

Am I missing something here? What is the right way to handle these situations?

  • +1 because I am curious to see some of the answers from sec experts on this – Chris O'Kelly May 9 '13 at 6:30

Your concern is justified, this behavior should not be allowed. Quoting myopenid help page:

OpenID is a decentralized identity system. An OpenID identity is just a URL. All OpenID does is provide a way to prove that you own a URL (identity).

Any additional information associated to that URL is not [necessarily] trusted, unless the OpenID provider also happens to be authoritative to that information (for instance, Google is an OpenID provider and an e-mail provider, so when Google says "the owner of this [google] URL is also the owner of this GMail account" you can trust it). Even those sites that take additional steps to validate the users' e-mail addresses are still not authoritative to them, and the validation only proves that the user controlled the address at the moment of validation (i.e. the e-mail might have changed hands, if it's a corporate e-mail for instance, or the user might have registered with a shared e-mail, etc).

The proper behavior would be either:

  • Register two distinct accounts with the same e-mail address;
  • Deny the creation of the second account (if for any reason the e-mail address must be unique);
  • Offer to link/merge both accounts, requiring that the user authenticates again with the first account, thus proving s/he owns both URLs (the associated info being irrelevant).
  • Good answer. Note that old versions of github.com/dairiki/authopenid-plugin (an OpenID plugin for Trac) used to do this too. It just derived the user name from the OpenID data, without checking if the username was already in use. Recent version correctly check the OpenID URL. – sleske Oct 28 '13 at 20:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.