What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

When login stackoverflow (or other open ID sites) if I am already logged in in an open ID site I simply "click" on the open ID logo of the account and ZAA! I am logged in...

so..this is my simple question..

What if a site just "don't wait me to click" and read the cookies from open ID's

Am I right if I think that any page could know who is browsing? (know his/her open ID) (I think this is real)

and what about the site could read that information and use it to log in in other sites? (I hope this is not that way)

Thanks for any comment

share|improve this question

2 Answers 2

The site can't read the OpenID cookies. Here's the workflow (very simplified, and probably totally wrong; I'm anything but an OpenID expert):

  1. You are on supersite.com and click "Login with AwesomeOpenID".
  2. That takes you to

    awesomeopenid.com/login_to_site?return_to=supersite.com/login_ok
    

    At the same time, supersite.com sends a secret to awesomeopenid.com through a backchannel, so you don't know this secret.

  3. The site awesomeopenid.com/login_to_site tells you "supersite.com says you want to log in there. First of all, do you even have an OpenID on awesomeopenid.com?"
  4. You say "yes I do" by entering your password for awesomeopenid.com. Alternatively, if you have logged in there before, awesomeopenid.com has already stored a cookie in your browser, so it knows you, because your browser automatically sends the cookie – but it sends it only to awesomeopenid.com. Either way, awesomeopenid.com now know it's you.
  5. Next, awesomeopenid.com asks you "Ok, now that I know it's you, do you really want to log in to supersite.com?" Alternatively, you have previously told awesomeopenid.com that if asked to log you in to supersite.com, that's fine, just do it. Either way, awesomeopenid.com now know that a) it's you and b) you really do want to log in.
  6. Okay, says awesomeopenid.com, and redirects your browser to supersite.com/login_ok?secret=42. Because only awesomeopenid.com could have known the secret, supersite.com now knows that you do in fact have an OpenID with awesomeopenid.com.
share|improve this answer
    
I think If supersite.com decide to check to awesomeopenid.com with -every browsing user- (without waiting him to click login) whether have or haven't an OpenId in awesomeopenid.com, so it can (at least) know who is browsing, am I wrong? –  please delete me May 5 '10 at 16:12
    
@Hernan: No -- as long as you don't confirm your login to supersite.com on awesomeopenid.com (or have previously allowed automatic login), supersite.com won't know anything. –  balpha May 5 '10 at 16:59

You first off have to give permission to the site when you login. When you first signed up (assume google) it says "Site stackoverflow.com would like to allow this login" or something similar. You hit "okay" and now Google knows that stackoverflow.com is a site that can access this information.

If you clear your cache and cookies you'll notice that you have to relogin with your OpenID provider. Again, assuming Google it will store a cookie on your machine and this says you're logged in with Google and during the login process will bounce you to logged in without having you actually login with your OpenID.

share|improve this answer

You must log in to answer this question.