1

It appears that it's possible for a malicious person to use the multiple OpenID logins feature to steal someone's account, if they have access to a logged-in session:

  1. Alice logs in to Stack Overflow with her normal OpenID account (Google, say).
  2. Alice steps away from her computer, leaving Stack Overflow logged in
  3. Eve wanders past and notices the open Stack Overflow session
  4. Eve goes to Alice's profile -> My logins
  5. Eve adds another login, one of her own OpenID accounts
  6. Eve then removes Alice's Google login and logs out

When Alice returns, she can no longer log in to her existing Stack Overflow account, since her only login method is no longer associated with it. Instead, Eve has full access to her account.

Is this considered a problem?

  • 4
    "if they have access to a logged-in session" - airtight hatchway problem... – AakashM Jan 30 '14 at 10:37
  • Admittedly these problems can be sorted using "relogging in on change log in details" – Richard Tingle Jan 30 '14 at 10:38
  • 1
    This isn't exclusive to OpenId. You could do this with many login systems. Instead of adding a different login, you change the login email and password – psubsee2003 Jan 30 '14 at 10:38
  • 1
    @psubsee2003 On my phone if you want to change the passcode you have to reenter the old passcode, which solves this problem – Richard Tingle Jan 30 '14 at 10:41
  • @AakashM - agreed, you shouldn't leave your computer unattended and sessions logged in. But many people do, especially sessions on non-critical sites like SO (as opposed to banks, say). – Chowlett Jan 30 '14 at 10:42
  • @RichardTingle - how do you mean "relogging in on change log in details"? Alice can't log in any more - Eve removed her method of authenticating. Thanks for pointing out the "Confirm old password" thing, though, saves me some typing :) – Chowlett Jan 30 '14 at 10:42
  • @Chowlett basically my first and second comment were the same, the second just explained it better – Richard Tingle Jan 30 '14 at 10:46
  • @RichardTingle - ahh, OK. But reauthenticating the user doesn't help in case of an OpenID login; if the user has left the session at the relying party logged in, chances are their session at the provider is also still logged in. – Chowlett Jan 30 '14 at 10:48
  • @Chowlett You make a fair point. Adds yet annother reason I don't like openID – Richard Tingle Jan 30 '14 at 10:49
  • 2
    I thought there is a way to force reauthentication with openid. I sometimes get my google login window on other sites although I am already logged in to that site. – Tim Seguine Jan 30 '14 at 11:12
5

Is this considered a problem?

Yes, this is a problem, but none on the side of Stack Exchange. Shall we try a car analogy?

If I leave my car, and the door is not locked and my keys are still in the car, everyone can steal my car easily.

Now this sounds stupid, of course they can! But is that now a problem of the car manufacturer? If that car now happens to have some sort of access card glued to the windshield to enter a parking garage in some building, the thief can now easily enter said parking garage with this car. But is that a problem of the security department of said building?

Long story short, yes, this is a problem if it happens, but it's not a problem Stack Exchange can prevent. Of course Stack Exchange could add additional "security" by needing to re-authenticate if you want to add a login, but you're most likely also logged in at your OpenID provider at that moment so there's a good possibility the provider will simply say "yupp, that's the user" and Stack Exchange will happily continue on.

The general rule is: If somebody has access to your running user session (on your computer), you already lost.

  • 2
    Fair enough. FWIW, I did know that if a crook has access to your running session then you've already lost. But I also know that there are steps that can be taken to mitigate this (e.g. requiring reauthentication for a password change), and was curious a) whether there was an equivalent for OpenID logins, and b) whether anyone cared. – Chowlett Jan 30 '14 at 10:59
  • 1
    @Chowlett: Well, requesting a (separate) password from the user pretty much defeats the purpose of OpenID in the first place. I also did a very quick look at OpenID if it supports some sort of "please ask for the password aqain" parameter but did not find any...that option would also be at best fishy, as it depends on the provider if it really asks for the password again. – Time Traveling Bobby Jan 30 '14 at 11:03
  • 1
    @TimeTravelingBobby: I tried that too, but all I could find was complaints about its absence. IMO, that's a pretty big flaw in OpenID, especially considering that it should not be a difficult feature to add. (Yes, it would require trusting the OpenID provider to implement it correctly, but then, so does everything else with OpenID. With an incompetent / insecure provider, all security goes out the window.) – Ilmari Karonen Jan 30 '14 at 12:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .