4 ms·

I don't have any problem with OpenID itself, and in fact I worked on the PIP project at Verisign briefly. That statement is more about the difference in design

by zedshaw 16y ago

I don't have any problem with OpenID itself, and in fact I worked on the PIP project at Verisign briefly. That statement is more about the difference in design, that OpenID has been marketed as some kind of protection against evil sites. It's an evil site, no amount of OpenID is going to protect you. I also disagree with the idea that OpenID protects against phishing, since well, if one site can be phished then an OpenID site can too. Phishing is a failure of usability in the browser, so all websites are vulnerable to it. Basically, my objections with OpenID are more in how it's marketed as some protection against things which really aren't a protocol problem or can't be solved by OpenID.

srean 16y ago
Ok that clears the air :) I agree that if as an user I trust the "customer" to take me to my OpenId provider then it provides no protection against phising. I totally agree that phishing is not a protocol problem and cannot be solved at a protocol level.Thankfully I wasn't exposed to that marketing, so to me OpenId was mostly an issue of convenience. However the common modality of breaking OpenId security can be mitigated if I login to my OpenId provider first. I think your concern is that my OpenId provider itself might be a phishing trap. Yes, if I fall for that, then all bets are off. But ideally I should be typing its url on my browser or going from a bookmark.
- zedshaw 16y ago
  You're also forgetting that the OpenID provider could be storing passwords and things wrong too, or that they've been hacked and someone's collecting them in-transit. Really, any attack against a non-OpenID site is available to an OpenID site, but with the added problem that nobody has to know. For example, if google had a security breach (ehem China?) and passwords got snarfed for a period of time, how would you or a customer site know? In addition to those attacks, there's economic attacks available from the provider. One day Google can just decide they don't like you and poof there go your users. For a customer this is a pretty big problem that they all must worry about. And, all of those attacks are pretty much available to any login system.
  - srean 16y ago
    Yeah that's what I meant by "phishing trap". In retrospect not a good choice of words, "compromised" would have been better. I am letting it remain as it is because you commented on it. I think a better way to express my opinion about OpenId is this: say I trust that the probability a particular site will not be compromised is (1 - \epsilon). Then OpenId lets me maintain and transfer that value of trust over authentication transaction with other sites. As the saying goes, it is as strong as the weakest link. There are protocols by which one can boost the level of trust beyond that (1 - \epsilon) but I have not come across a easy to use deployment of one such.

by zedshaw 16y ago

srean 16y ago

Ok that clears the air :) I agree that if as an user I trust the "customer" to take me to my OpenId provider then it provides no protection against phising. I totally agree that phishing is not a protocol problem and cannot be solved at a protocol level.Thankfully I wasn't exposed to that marketing, so to me OpenId was mostly an issue of convenience. However the common modality of breaking OpenId security can be mitigated if I login to my OpenId provider first. I think your concern is that my OpenId provider itself might be a phishing trap. Yes, if I fall for that, then all bets are off. But ideally I should be typing its url on my browser or going from a bookmark.

zedshaw 16y ago
You're also forgetting that the OpenID provider could be storing passwords and things wrong too, or that they've been hacked and someone's collecting them in-transit. Really, any attack against a non-OpenID site is available to an OpenID site, but with the added problem that nobody has to know. For example, if google had a security breach (ehem China?) and passwords got snarfed for a period of time, how would you or a customer site know? In addition to those attacks, there's economic attacks available from the provider. One day Google can just decide they don't like you and poof there go your users. For a customer this is a pretty big problem that they all must worry about. And, all of those attacks are pretty much available to any login system.
- srean 16y ago
  Yeah that's what I meant by "phishing trap". In retrospect not a good choice of words, "compromised" would have been better. I am letting it remain as it is because you commented on it. I think a better way to express my opinion about OpenId is this: say I trust that the probability a particular site will not be compromised is (1 - \epsilon). Then OpenId lets me maintain and transfer that value of trust over authentication transaction with other sites. As the saying goes, it is as strong as the weakest link. There are protocols by which one can boost the level of trust beyond that (1 - \epsilon) but I have not come across a easy to use deployment of one such.