If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?

1 Answer 1


OAuth and OpenID don't send your password to the sites you use OAuth/OpenID providers to login with, so no. Not unless the attack is performed on the OAuth/OpenID provider and provider's servers are vulnerable to CVE-2014-0160 (The Heartbleed Bug). It is however possible, of course provided that sites you're logging into using OAuth/OpenID providers are vulnerable to Heartbleed, that other information could leak, like say your email address, or user session information with which it could be hijacked for the duration that it is valid for.

  • But OAuth (for example) sends your authentication tokens. Aren't those tokens themselves vulnerable to hijack? Apr 11, 2014 at 8:47
  • 1
    @GrahamBorland Yes, I say that already in my answer. The tokens are nonces, so they're unique and used only once per session authorisation, but the same user session that the nonce is leaked could potentially be hijacked, if they're used before they expire. To thwart against that however doesn't require (in this case, like OP describes) change of password, signing out and logging back in with the same OAuth/OpenID providers would generate new session nonces. Tho it might be pointless, because those nonces are usually valid only for a very short time. It would depend on the provider though. ;)
    – TildalWave
    Apr 11, 2014 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .