1

This question may be related to this one, but I think we need to be sure.

My website implement login via OpenID (or Google, or Facebook, etc.).

On my website, authorization is based on user email adress. If user has email [email protected], she gets access to the content linked to that email address. (Basically in my case, content sent by other users to her email address.)

I do not provide other ways to login than third party auth and single use token. User sometimes connect via OpenID sometimes via token.

I guess when new user login for the first time via OpenID, I should in fact verify that she really owns the email address ? Then only, I can store the provider as "trusted" for this email address.

Does anything prevent anyone to set up an OpenID provider, to make it provide someone else email address, and to get privileges linked to this email address on my website ? Can I make a list of "trusted" providers (like Launchpad.net, Facebook, Google) which are known to verify user email address ?

I am pretty sure about the answer, but I need a confirmation. I want to make my login system as light as possible especially for new users. So I would not like to add tasks for the user if it is not mandatory.

Improve this question

3 Answers 3

Reset to default
4

If you're allowing any OpenID provider like StackExchange appears to do:

SE login

then you should probably validate the email address separately by sending a confirmation email containing a verification link (like SE do) before allowing access.

Improve this answer
3

You need to differentiate between trusted and non-trusted providers.

Google and Facebook are trusted providers because they do verify user's email address. Of course, it's theoretically possible someone within Google could fake their email address. But pragmatically, I'd be happy to just trust an email address from a major provider.

Anyone can set up their own OpenID server and make it say any email address they like, so you can't trust that.

Improve this answer
0

When you use OpenID to authenticate user, you use an explicit list of providers that you will accept. It is up to you whether you will trust any individual provider, because you are basically delegating authentication to these providers: you are entrusting them to tell you whether a specific user has connected, and to provide identity data relative to that user. Your server will not trust any provider who is not in its list of trusted providers.

E.g. see what StackExchange.com themselves do: they have a list of OpenID providers that they accept (i.e. deem "trustworthy") and you may log in using your account on one of these providers, but not any other.

If you want a "verified email address" then you should trust only providers who have demonstrated that they implement email verification procedures that you deem sufficient.

Improve this answer
2
  • Reading the answers, I probably have to use an explicit list of providers (at the moment I don't). And many libraries don't : github.com/jaredhanson/passport-openid for example. Facebook and Google took all but their was a time I could connect on Dailymotion just entering launchpad.net/~guilro in a text field. Launchpad was not explicitly accepted. I cannot remember if they asked to confirm my email address.
    – jillro
    Jan 15, 2014 at 21:32
  • SE.com allows you to login via any OpenID URL it seems: Or, you can manually enter your OpenID - I've not tested this to see what validation occurs though.
    – SilverlightFox
    Jan 16, 2014 at 10:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .