26

I am reading OpenID in depth. I found a bug / hack. I think this is not good thing in openid.

let me explain what I did :-

  1. clear all history of my Firefox.
  2. Login into Stackoveflow with Google
  3. signout from stackoveflow and Google.
  4. check history and copy google OpenID return (like https://stackoverflow.com/users/authenticate/?s=fe4fde6d-90.......... I am not pasting full URL because it is my account URL :-))
  5. visit this URL, and I am Logged in my SO account. (I tried that in different browsers, different PC's and different location also)

What is this I think any one can hack my account easily If I don't clear history. What is your thoughts about that.

  1. Is OpenID not secure or have a any procedure for that.
  2. Why stackoverflow using this kind of insecure login system.
  3. Why Google provide this kind of insecure Authentication system.
  4. May be I am wrong please tell me. I am not experienced programmmer.

Edit :

I tried with Livejournal also and same problem here.... :-) wow what is happening?

I tried with some others site and they don't allow to login with that URL multiple time.

4
  • cool question! i would love to know if other websites that have openID authentication also have the same problems.
    – Sriram
    Aug 4, 2011 at 5:58
  • @Sriram : tried with Livejournal also and same problem here Aug 4, 2011 at 6:13
  • is there any one from stackoverflow? because not all OpenID consumer sites allow same url more then one time. Aug 4, 2011 at 6:30
  • 1
    Gr8, its really working.. Aug 4, 2011 at 11:20

2 Answers 2

10

That should not happen. There should be a "nonce" in the URL, and Stackoverflow should not accept the same URL twice. It is up to Stackoverflow to verify that the URL can only be used once. It should also time out eventually (I guess it will at least do that).

3
  • you mean it is fault of Stackoverflow? Aug 4, 2011 at 5:54
  • 4
    It sounds like that. Can you try the same on other OpenID sites?
    – Thilo
    Aug 4, 2011 at 5:55
  • It is also in live journal , I tried this Aug 4, 2011 at 6:10
5

This is a time limited token, so you will only be able to do this for (n) minutes.

Unable to log in with your OpenID provider:

The message expired at 8/4/2011 8:22:22 AM and it is now 8/4/2011 10:22:19 AM.

2
  • 20
    why not for once? any special reason? Aug 4, 2011 at 10:24
  • 3
    And what is the value for (n) ?
    – Thilo
    Aug 5, 2011 at 3:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .