4 ms·
Perhaps you should try something before you dismiss it. Sites you log into using OpenID never see your password. (For that matter, any competent OpenID provide
by sbierwagen 16y ago
Perhaps you should try something before you dismiss it.
Sites you log into using OpenID never see your password. (For that matter, any competent OpenID provider will never store your password in cleartext, so they won't know it either.) The only thing the site knows is your OpenID url, and when you sign in using that, it redirects you there, to enter your password.
Live example. I use myopenid.com to provide OpenID services, delegated via a link rel="openid.delegate" tag on my personal site, bbot.org.
When I want to sign in via OpenID on a site, say, livejournal, I type in "bbot.org". Livejournal looks at that site, reads the link tag, and sends me to myopenid.com. I sign in there, and it sends me back to livejournal, now logged in.
- loewenskind 16y agoOk, so browser phishing protection should prevent a hostile site from being able to fake this work flow then, right? In that case I guess I can live with it. I'll just have to go to the effort of setting up my own openID provider since I still don't want different sites tying my ID together so I'll have to set something up on my side. This is all a lot more effort than it was before and I don't see any benefit at all to how I use the internet. But thanks for giving a detailed explanation of how it works. At least my security concerns are lessened (still, compromising one site and logging passwords will compromise every site you use this service with).