Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

When login stackoverflow (or other open ID sites) if I am already logged in in an open ID site I simply "click" on the open ID logo of the account and ZAA! I am logged in...

so..this is my simple question..

What if a site just "don't wait me to click" and read the cookies from open ID's

Am I right if I think that any page could know who is browsing? (know his/her open ID) (I think this is real)

and what about the site could read that information and use it to log in in other sites? (I hope this is not that way)

Thanks for any comment

share|improve this question

The site can't read the OpenID cookies. Here's the workflow (very simplified, and probably totally wrong; I'm anything but an OpenID expert):

  1. You are on and click "Login with AwesomeOpenID".
  2. That takes you to

    At the same time, sends a secret to through a backchannel, so you don't know this secret.

  3. The site tells you " says you want to log in there. First of all, do you even have an OpenID on"
  4. You say "yes I do" by entering your password for Alternatively, if you have logged in there before, has already stored a cookie in your browser, so it knows you, because your browser automatically sends the cookie – but it sends it only to Either way, now know it's you.
  5. Next, asks you "Ok, now that I know it's you, do you really want to log in to" Alternatively, you have previously told that if asked to log you in to, that's fine, just do it. Either way, now know that a) it's you and b) you really do want to log in.
  6. Okay, says, and redirects your browser to Because only could have known the secret, now knows that you do in fact have an OpenID with
share|improve this answer
I think If decide to check to with -every browsing user- (without waiting him to click login) whether have or haven't an OpenId in, so it can (at least) know who is browsing, am I wrong? – please delete me May 5 '10 at 16:12
@Hernan: No -- as long as you don't confirm your login to on (or have previously allowed automatic login), won't know anything. – balpha May 5 '10 at 16:59

You first off have to give permission to the site when you login. When you first signed up (assume google) it says "Site would like to allow this login" or something similar. You hit "okay" and now Google knows that is a site that can access this information.

If you clear your cache and cookies you'll notice that you have to relogin with your OpenID provider. Again, assuming Google it will store a cookie on your machine and this says you're logged in with Google and during the login process will bounce you to logged in without having you actually login with your OpenID.

share|improve this answer

You must log in to answer this question.