How to handle two sets of OpenID credentials providing the same information, on the same or different OpenID providers?

Question

I recently encountered a situation where one site assumed that if two different people's credentials for the same OpenID network produce the same email address then they were they same person. Also, less recently I encountered a situation where one site assumed that if two different OpenID providers produce the same email address then they are the same person.

Both of these seem like security concerns to me. Just because Facebook thinks my email address is [email protected] does not mean that you should give me access to [email protected]'s account on your site.

Am I missing something here? What is the right way to handle these situations?

Answer 1

Your concern is justified, this behavior should not be allowed. Quoting myopenid help page:

OpenID is a decentralized identity system. An OpenID identity is just a URL. All OpenID does is provide a way to prove that you own a URL (identity).

Any additional information associated to that URL is not [necessarily] trusted, unless the OpenID provider also happens to be authoritative to that information (for instance, Google is an OpenID provider and an e-mail provider, so when Google says "the owner of this [google] URL is also the owner of this GMail account" you can trust it). Even those sites that take additional steps to validate the users' e-mail addresses are still not authoritative to them, and the validation only proves that the user controlled the address at the moment of validation (i.e. the e-mail might have changed hands, if it's a corporate e-mail for instance, or the user might have registered with a shared e-mail, etc).

The proper behavior would be either:

• Register two distinct accounts with the same e-mail address;
• Deny the creation of the second account (if for any reason the e-mail address must be unique);
• Offer to link/merge both accounts, requiring that the user authenticates again with the first account, thus proving s/he owns both URLs (the associated info being irrelevant).