The Implications of OpenID

Google Tech Talks
June 25, 2007

ABSTRACT

Simon Willison
OpenID is an emerging standard that provides simple, decentralised authentication for the Web. OpenID follows the Unix philosophy, solving one small problem rather than attempting to tackle the many larger challenges posed by online identity. This talk will explore the implications of OpenID, and explore the best practices required to take advantage of this new technology while avoiding the potential pitfalls.

Speaker: Simon Willison
Simon Willison is a consultant on OpenID and client- and server-side Web development, and a co-creator of the Django Web framework. Before going frelance Simon worked on Yahoo!'s Technology Development...

Category:

Howto & Style

Tags:

• google
• howto
• implications
• openid

[Myrtone]

In addition to the problems mentioned in the video, note that there is a problem to exposing too many passwords to a user which relates to passwords being system codes, there is more on that on MeatballWiki.

[andjack]

@edgecrush3r se 17:30-18:30 in the video for the sollution for this question.

[edgecrush3r]

This is much worse because everything is centralized, so keeping different accounts still pay off. But yeah, its harder to manage.

[edgecrush3r]

I still not convinced about IDP spoofing, at all...

1. User visits a malicious RP page containing what looks like a regular OpenID login form.

2. User enters OpenID URL

3. Malicious RP redirects user to another page that looks like the user's OP (call this Fake-OP) using a proxy to load/modify the content.

4. Fake-OP asks user for password

User not noticing the difference from his usual OP, enters his password

5. Fake-OP now has user's password.

[DryBaboon]

Meh! Get roboform!

[XenTityX]

This is a great talk, and I had the same reaction to the phishing/credential stealing problem. He did sidestep around the actual problem, however, I realized a solution to this:

One Time Passwords. If your openID provider is hacked, they should only have the information required to authenticate you, not the secret information you have yourself. Look into technologies such as Yubico's Yubikey. Also, I'd hope any password auth provider would only store one-way hashes, not the pass itself.

[blackwire00]

I enjoyed the talk alot but i didnt like how he kinda kept avoiding interesting security issues with OpenID just by saying that the issues are already here. its not about whether or not openid is just as vulnerable as using ur email address across the internet and stuff. Its about what openid should do to combat this vulnerability. the whole "forgot my password" scam shouldnt be equivalent to openid, at least to me...

[mikehc23]

I would really like it too. Maybe trough gmail.

[zer0graph]

i'd really like to see Google start offering an OpenID service, and I could see Apple doing it as part of their .Mac service too.

The only big name right now is AOL, and I don't really like it.