If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?


OAuth and OpenID don't send your password to the sites you use OAuth/OpenID providers to login with, so no. Not unless the attack is performed on the OAuth/OpenID provider and provider's servers are vulnerable to CVE-2014-0160 (The Heartbleed Bug). It is however possible, of course provided that sites you're logging into using OAuth/OpenID providers are vulnerable to Heartbleed, that other information could leak, like say your email address, or user session information with which it could be hijacked for the duration that it is valid for.

  • But OAuth (for example) sends your authentication tokens. Aren't those tokens themselves vulnerable to hijack? – Graham Borland Apr 11 '14 at 8:47
  • 1
    @GrahamBorland Yes, I say that already in my answer. The tokens are nonces, so they're unique and used only once per session authorisation, but the same user session that the nonce is leaked could potentially be hijacked, if they're used before they expire. To thwart against that however doesn't require (in this case, like OP describes) change of password, signing out and logging back in with the same OAuth/OpenID providers would generate new session nonces. Tho it might be pointless, because those nonces are usually valid only for a very short time. It would depend on the provider though. ;) – TildalWave Apr 11 '14 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.