What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

I am reading OpenID in depth. I found a bug / hack. I think this is not good thing in openid.

let me explain what I did :-

  1. clear all history of my Firefox.
  2. Login into Stackoveflow with Google
  3. signout from stackoveflow and Google.
  4. check history and copy google OpenID return (like http://stackoverflow.com/users/authenticate/?s=fe4fde6d-90.......... I am not pasting full URL because it is my account URL :-))
  5. visit this URL, and I am Logged in my SO account. (I tried that in different browsers, different PC's and different location also)

What is this I think any one can hack my account easily If I don't clear history. What is your thoughts about that.

  1. Is OpenID not secure or have a any procedure for that.
  2. Why stackoverflow using this kind of insecure login system.
  3. Why Google provide this kind of insecure Authentication system.
  4. May be I am wrong please tell me. I am not experienced programmmer.

Edit :

I tried with Livejournal also and same problem here.... :-) wow what is happening?

I tried with some others site and they don't allow to login with that URL multiple time.

share|improve this question

migrated from stackoverflow.com Aug 4 '11 at 8:03

This question came from our site for professional and enthusiast programmers.

    
cool question! i would love to know if other websites that have openID authentication also have the same problems. –  Sriram Aug 4 '11 at 5:58
    
@Sriram : tried with Livejournal also and same problem here –  Govind KamalaPrakash Malviya Aug 4 '11 at 6:13
    
is there any one from stackoverflow? because not all OpenID consumer sites allow same url more then one time. –  Govind KamalaPrakash Malviya Aug 4 '11 at 6:30
1  
Gr8, its really working.. –  Dr. Rajesh Rolen Aug 4 '11 at 11:20

2 Answers 2

up vote 10 down vote accepted

That should not happen. There should be a "nonce" in the URL, and Stackoverflow should not accept the same URL twice. It is up to Stackoverflow to verify that the URL can only be used once. It should also time out eventually (I guess it will at least do that).

share|improve this answer
    
you mean it is fault of Stackoverflow? –  Govind KamalaPrakash Malviya Aug 4 '11 at 5:54
4  
It sounds like that. Can you try the same on other OpenID sites? –  Thilo Aug 4 '11 at 5:55
    
It is also in live journal , I tried this –  Govind KamalaPrakash Malviya Aug 4 '11 at 6:10

This is a time limited token, so you will only be able to do this for (n) minutes.

Unable to log in with your OpenID provider:

The message expired at 8/4/2011 8:22:22 AM and it is now 8/4/2011 10:22:19 AM.

share|improve this answer
20  
why not for once? any special reason? –  Govind KamalaPrakash Malviya Aug 4 '11 at 10:24
3  
And what is the value for (n) ? –  Thilo Aug 5 '11 at 3:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .