if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me?

Are they able to steal my contact info, name, etc (assuming I'm using Gmail OpenId)

4 Answers 4


If you authenticate to another website with Google's OpenID system, it will tell them that the person authenticating is in control that particular GMail address. Unless they get in-line between you and another site, they can't perform a MITM attack. They can only effectively take advantage of your credentials if they pretend to be your identity provider and you put your password onto the wrong website.

For a comprehensive look at what can go wrong with OpenID, Google says it better than I do: http://sites.google.com/site/openidreview/issues

  • 4
    The link you give is to a site hosted by Google but the content is not from them. It seems related to some IIW OpenID meeting.
    – nealmcb
    May 20, 2011 at 3:49

When you use a google OpenID to sign in to a site (which is thus an OpenID "relying party" or RP), the RP requests various forms of information, and gets it if you agree to provide it. Google tells you what they asked for. So yes, the RP can get contact info, with your permission.

But the design of OpenID is intended to protect the most important stuff - your authentication credentials (password or whatever).


Not exactly answering the question, but it's good to realize that by registering with OpenID, you are still entrusting the relaying party (e-shop, forum, etc.) with your personal data, and in many cases they will want to store it. So it's up to them if they protect the data from being harvested.

For example, recently I found out that an e-shop where I registered using OpenID, my email, real address, phone no, purchase history... was "protected" by 5-digit password, stored unhashed in the database.

So don't fall into a trap that by using OpenID you're somehow inherently safer. OpenID is a great idea, but you still have to trust all the parties. Obviously you have to trust the OpenID provider, but also each time you register with new e-shop, forum or whatever service, OpenID will pass info to them so you have to ask yourself:

  • "do they really need all this info?"

  • and "are they willing and competent enough to keep it safe?"


Keep in mind OpenID is a single point of failure. If they were hacked like the RSA Company then all accounts can be compromised. The trade-off is that if you have a problem like SQL injection and you only use OpenID, then an attacker would be unable to compromise accounts using this type of vulnerability.

  • If they were hacked ... who? OpenID is a technology, not somebody. Jun 24, 2014 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .