What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

Apparently, new users of the Stack Exchange Network automatically are being registered with an OpenID provider. The registration process appears misleadingly merely to offer an option to register with OpenID provider, openid.stackexchange.com, but in fact new users are being registered automatically with that OpenID provider without giving consent, and without being consulted or even told. (For potentially thousands of websites?)

For a user to feel comfortable registering with a single-sign-on provider (e.g. an OpenID provider), they must be told this is happening: informed consent is important in security. If we aren't clear about all the ways we are protected from other users of our own computers, what a feeling of unease could be generated! Obviously, if a user signs off from a website, it is important they not experience another person (without their credentials) reentering that website as them. Not merely regarding websites individually, single-sign-on providers further magnify this automatically to a tremendous and unknown number of other websites, at least potentially, in the mind of anyone who has not decided to register with a single-sign-on provider.

In the following, please note the many official references to Stack Exchange, and that the OpenID aspect of registration is presented as optional. These details show currently how signing up for the Stack Exchange Network actually means being signed up with an OpenID provider, specifically the surreptitious aspect of it:

  • A prospective user of stackoverflow.com sees no signup link, and follows its top-menu link, 'log in', which leads to, 'click here to sign up.'
  • The resulting page with a big, blue label, 'Stack Exchange' has a button, 'Create Stack Exchange Account'.
  • After signing up, the user receives an email with the subject, 'Complete Registration on stackoverflow.com'.
  • The email contains the text, 'You're almost done!...Once you create your Stack Exchange account you can use it to log in to thousands of websites. To log in to a Stack Exchange site: click the "Log in with Stack Exchange" button. To log in to other websites that accept OpenID: enter this URL https://openid.stackexchange.com/' . Apparently, this offers a choice, and one of the meanings of the word, 'can' is, 'at most, potentially'.
  • Not wanting to go further with an OpenID feature at this time, the user avoids the above advertised URL, 'openid.stackexchange.com'. Instead, (in the email) the user clicks a button labeled, 'Click here to complete your registration on stackoverflow.com'.
  • After completing this registration, the user checks whether they can log out and back in again.
  • The registration leaves the user's current URL as stackexchange.com. There, the top-menu link 'log in' results in the question, 'Do you already have an account on one of these sites? Click the logo to log in with it here.' One of the cards says, 'log in with Stack Exchange'. The user clicks this.
  • The resulting page with a big, blue label, 'Stack Exchange' says, 'Sign in with your Stack Exchange account'.
  • A successful login results in the Stack Exchange homepage.
  • Clicking the top-menu link, 'log out' leads to a page with a big, blue label, 'Stack Exchange' saying, 'You're a registered user. You recently used the following credentials to login'. Listed first is an apparent option (in blue), 'Email' with the user's email address, 'You can login with any...Stack Exchange account that uses any of the emails above.' Next apparently is another option (because it is also in blue): 'OpenID / Stack Exchange' with no other information.
  • Last is an orange button labeled, 'Log Out', plus the text, 'Clicking Log Out will clear all local credentials in your browser'. Clicking this results briefly in the message, 'Clear Global Credentials'; then the user sees the public version of the Stack Exchange homepage.

So, the would-be user of stackoverflow.com apparently has registered with stackexchange.com, because stackoverflow.com said this was necessary. (Trusting stackoverflow.com, they trusted where it sent them to register. However, they were actually registering instead with openid.stackexchange.com unawares.)

Already, they were comfortable with families of websites that are subdomains of the same domain name, because browsers provide cookie protection to users of such subdomain families. (For example, signing in at accounts.google.com leads us to mail.google.com.) Albeit, it did not occur to the user that stackexchange.com and stackoverflow.com do not share a common domain name.

The user had not considered, was unready, and was unwilling because of security concerns to take the step of registering with any single-sign-on provider, for example openid.stackexchange.com, and they had chosen deliberately not to do so. However, in fact, they had been registered automatically and surreptitiously with the OpenID provider.

Logically, either it is possible, or it is impossible, for any user without an OpenID provider to sign in once, and access the entire Stack Exchange Network.

If it is possible, Stack Exchange could allow new users to register without an OpenID provider, as well as optionally by using an OpenID provider. If it is impossible, new users could be alerted and informed they must use an OpenID provider. Certainly, either way, openid.stackexchange might be suggested.

If it is impossible, openid.stackexchange might also be dedicated specifically only to the Stack Exchange Network, with a policy guaranteeing this to the users. Then, a sign out from any website of the Stack Exchange Network could automatically sign out the user from the dedicated OpenID provider as well. If a user trusts this statement of policy, they might judge this method safe for them.

share|improve this question
add comment

4 Answers

I'm not sure I understand why you have a problem with the current behaviour. That you can use the StackExchange account as an OpenID provider for other sites is an entirely optional feature. You can just never authorize any other site to use the SE OpenID account, you need to explicitly grant a site permission to use your OpenID account.

Many other big sites, e.g. Google and Yahoo can also work as OpenID providers, and they don't make that explicit on sigining up. I personally don't see any problem with that, as OpenID is an entirely optional feature.

share|improve this answer
    
There is a UI problem with the current behavior, because what is represented as 'globally' logging off does not stop another person then posting as that same user, of StackOverflow (etc.), because of the mandatory OpenID.StackExchange.com cookies (mysterious to naive users). –  MarkDBlackwell Jan 9 '12 at 9:38
10  
That's a different problem from what you describe here, I agree that this logout behaviour is dangerously confusing to users that don't know about OpenID. The problem is not that SE uses OpenID by default, the problem is that the logout process doesn't make it clear what happens. –  Mad Scientist Jan 9 '12 at 9:41
    
See below on education not being enough. Does 'SE [only] use...OpenID by default,' as you say, or is it mandatory? My impression is it's mandatory. –  MarkDBlackwell Jan 9 '12 at 9:49
3  
Logging out is overrated. anyway. ;p –  Grant Thomas Jan 9 '12 at 9:54
    
If it's OpenID only by default, I will switch, right now! :) –  MarkDBlackwell Jan 9 '12 at 10:03
    
Now no longer a new user and OpenID-naive, I have switched to using Google credentials to log in. :) –  MarkDBlackwell Jan 9 '12 at 21:28
    
If a naive user has left cookies for openid.stackexchange.com in their browser, authorizing any other site to open an account in that user's identity is as easy as a few clicks (see below), for anyone briefly borrowing the keyboard. Defense should be in depth, as you know! –  MarkDBlackwell Jan 9 '12 at 23:23
    
There is a severe potential reputation problem in Stack Exchange quietly using OpenID under the covers, because to new users this is a weighty step to consider and approve. Instead, this should be done upfront. A few publicized identity thefts could tarnish Stack Exchange by association. In 2009, someone calling themselves Andrew Arnott spoke of a danger to OpenID from public perception, that it 'will only need to happen once or twice and have someone's identity stolen for the press to give OpenID a big black eye.' And Stack Exchange too, possibly. –  MarkDBlackwell Jan 10 '12 at 1:05
    
@AndrewArnott, since your profile says, 'Loving all things identity: OpenID', may I ask whether you are the same Andrew Arnott who wrote this? lists.openid.net/pipermail/openid-general/2009-April/… –  MarkDBlackwell Jan 10 '12 at 1:08
    
He also says, relevantly, 'I think it behooves us to encourage all RPs to have Logout buttons that have a popup asking if they want to log out of their OP as well.' –  MarkDBlackwell Jan 10 '12 at 1:31
    
Actually, logging out seems underrated, perhaps naturally by some who have laptops they don't let anyone else use. They don't need it. –  MarkDBlackwell Jan 10 '12 at 19:19
add comment

I don't think creating an SSO-capable account without informing the user is inherently wrong. It's also very common; Google, Facebook, Yahoo! and others have done the same, often retroactively. Your remark "For potentially thousands of websites?" makes me suspect you may misunderstand how the Stack Exchange OpenID works: you will only be automatically logged in to sites after you have authorized them. If you don't chose to authorize a site it will not be aware of you.

I do feel that the behaviour is dangerously confusing and should be improved. As I said in the thread that lead to this one:

SSO is pretty unintuitive, and particularly so when the provider and consumer are on the same domain. Considering that SE is now trying to appeal to relatively non-tech-savvy users, it should be considered a security problem that so many users will not understand how logging out of their account works.

share|improve this answer
    
even more education is not enough, because some people, some time, will log off 'globally' from one of the StackExchange websites and forget to access openid.StackExchange.com and log off from it, too, then turn a computer over to someone else, feeling safe, when they shouldn't. –  MarkDBlackwell Jan 9 '12 at 9:29
    
Like many other new users being courted by StackExchange, not only did I misunderstand how the Stack Exchange OpenID works, I was totally OpenID-naive. It is good to be informed that each new site to which someone might supply URL, openid.stackexchange.com for authorization, won't work until 'I authorize it'. Is that what you mean? If a naive user has left cookies for openid.stackexchange.com, what is involved in authorization? Just a click? –  MarkDBlackwell Jan 9 '12 at 21:45
1  
@MarkDBlackwell Yes, just a click. I should probably have just referred to it as "confirmation". –  Jeremy Banks Jan 9 '12 at 21:48
    
Indeed, I did suspect you to think I might think I would have a database presence on sites I had never heard of, before. But, no worries! :D –  MarkDBlackwell Jan 9 '12 at 22:55
add comment

The other answers here are good. The only remaining and unaddressed merit I see in your question is around cookies and different top-level domain names. So let's take OpenID completely off the table, as that is irrelevant. It is merely the authentication protocol the StackExchange network hpapens to have chosen to use within its network of sites.

So your concern is that there is no single-sign-out within the StackExchange network due to two facts:

  1. Different TLDs lead to cookie behavior that most web users do not expect. Specifically that logging out doesn't clear a single cookie that impacts the entire network of SE sites.
  2. The fact that StackOverflow (and other SE sites) don't make up for #1 by implementing single-sign out.

If that is an accurate summary, then I think asking SE to resolve the issue by resolving #2 above is perfectly reasonable.

share|improve this answer
    
Hiding use of OpenID in implementing authentication for a family of websites seems unquestionably okay (regardless of cookies) if both: 1. outside websites are disallowed, and 2. each inside-website signout causes OpenID server signout. Alternatively, with disclosure of OpenID, supporting outside websites seems unquestionably okay if 2. still holds. Breaking 2. seems okay if users are informed enough. –  MarkDBlackwell Jan 18 '12 at 21:28
add comment

The StackExchange registration web pages, if the new user selects 'authorization with StackExchange', should include this warning text (important for OpenID-naive new users).

"Security note: this will involve using an OpenID provider. If you are unfamiliar with OpenID, probably you should consider instead using your credentials from Google (or somewhere else).

"If you know what you are doing with OpenID, and still you want to use the StackExchange OpenID provider, you will need to be careful, every time, to log out as well from openid.stackexchange.com, in addition to any other StackExchange sites you wish to log out from, or those sites will be reaccessible (as you) in just a few clicks."

These statements are true, right? Scary, but security is important. People with established access to StackExchange might not care about new users, but StackExchange evangelists should.

share|improve this answer
2  
I'm a stackexchange evangelist, I'm concerned about security, and I know full well what an OpenID provider is, and why anyone would care about them. What I don't get is your point. My jaw just hangs open with "huh?" after reading this. –  jcolebrand Jan 10 '12 at 15:35
    
Mark - can you outline what you think the key security concerns are here. I'm with @jcolebrand on this one...wondering. –  Rory Alsop Jan 10 '12 at 15:42
1  
A re-reading makes me think that the core problem here is the fundamental misunderstanding of OpenID ... –  jcolebrand Jan 10 '12 at 15:45
    
I believe MarkD's concern is that the user may not understand that Stack Exchange login works as an OpenID, thereby having to log out from Stack Exchange the site as well as Stack Exchange the OpenID provider side. This would seem to be a problem on shared PCs, I suppose. I don't see any other situation where it'd be cause for concern –  Sathya Jan 10 '12 at 15:51
    
@Sathya, you are exactly correct about part of the concern: regarding naive users on public computers, or even letting someone else (at a party) 'just check something' on one's own computer--for (multi-layered) defense in depth. The other part is preventing possible journalist mention, in a gripping story about naive users suffering identity theft, of failure to inform users by Stack Exchange. –  MarkDBlackwell Jan 10 '12 at 19:13
    
Plausibly, a well-socially-connected, naive user could feel a significant emotion of betrayal if they discovered that a way to establish their identity had been left available on an acquaintance's computer, and they might know such a journalist. –  MarkDBlackwell Jan 10 '12 at 19:30
    
Making it explicit (admitting error) may be difficult for the designers because hiding it was a design goal, I see: 'We're also looking to streamline logins with this new provider, ideally making it so that a normal user would be unaware anything more sophisticated than standard U/P login is going on.' –  MarkDBlackwell Jan 11 '12 at 10:18
    
Seemingly, Stack Exchange would serve their own interest by being proactive—rather than delaying till prodded by a journalistic news story which might reach general public awareness, like this one about Target Corp.'s security breach (or a more general one). Such a story might include (as part of a list) the security breach of someone's Stack Exchange account. –  MarkDBlackwell Mar 5 at 16:27
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .