3 ms·
OpenID may prevent stealing login credentials, but it doesn't prevent stealing the cookie which identifies your session.
by bensummers 15y ago
OpenID may prevent stealing login credentials, but it doesn't prevent stealing the cookie which identifies your session.
- wisty 15y agoAlso, if you can hijack the http, you can link to a phishing site which prompts users for their OpenID provider (typically their google account) credentials. Maybe they would notice that the domain name of the phishing site (say googleopenid.com, which is available) is fishy ... https gives you more than just encryption.