I am reading OpenID in depth. I found a bug / hack. I think this is not good thing in openid.
let me explain what I did :-
- clear all history of my Firefox.
- Login into Stackoveflow with Google
- signout from stackoveflow and Google.
- check history and copy google OpenID return (like https://stackoverflow.com/users/authenticate/?s=fe4fde6d-90.......... I am not pasting full URL because it is my account URL :-))
- visit this URL, and I am Logged in my SO account. (I tried that in different browsers, different PC's and different location also)
What is this I think any one can hack my account easily If I don't clear history. What is your thoughts about that.
- Is OpenID not secure or have a any procedure for that.
- Why stackoverflow using this kind of insecure login system.
- Why Google provide this kind of insecure Authentication system.
- May be I am wrong please tell me. I am not experienced programmmer.
I tried with Livejournal also and same problem here.... :-) wow what is happening?
I tried with some others site and they don't allow to login with that URL multiple time.