Black Hats on OpenID
Document Actions
Black Hats on OpenID
From Bob Blakely, a
pointer (via Pemela
Dingle) to this
article on OpenID that was given at the last Black Hat security
conference. There are some very interesting points made on OpenID security.
Some takeaways from the article:
- An OpenID provider knows all the sites you authenticate to. From a privacy standpoint, I am not personally OK with that. Others will have different pain thresholds on this.
- OpenID is vulnerable to session hijacking if the redirect to from the OpenID provider to the relying party is not done over SSL. This would obviously apply to both the OP and RP. Of course while this is certainly a danger, it is no different than the risk of session hijacking that can happen at any time after authentication, as I discuss here.
- If the user can be lured to malicious site, a cross site request forgery attack can be used. The attacker could try to guess other sites that the user might have OpenID enabled and count on the fact that the by authenticating to the malicious site, the user now has a current session at the OpenID provider. If OpenID ever reaches widespread adoption for sensitive applications (i.e. the kinds that attack hackers), this kinds of attack will be very likely.
_____
tags:
Strong Auth to OpenId IDPs
Posted by
Dave at IronKey
at
2007-08-24 03:40
As CEO of IronKey, and Chairman of the Anti-Phishing Working Group (http://www.antiphishing.org), I am glad to see a discussion of the security vulnerabilities of OpenID. Frankly, without strong 2-factor authentication, centralized password management or OpenID IDPs is just too risky. As the author points out, phishing has not been solve (and I don't think it ever will be "solved").
If your login credentials to your IDP are compromised, it's game over for your identity on the Internet. The same is true of Liberty Alliance or any federated identity system.
If your login credentials to your IDP are compromised, it's game over for your identity on the Internet. The same is true of Liberty Alliance or any federated identity system.
Forgot your password?
New user?
http://www.readwriteweb.com/archives/attention_economy_overview.php
Happy reading, thats a long one.
Cheers,
Tara