2

When I'm already logged into openid.stackexchange.com (aka SEOpenID) then I am able to log into stackexchange.com (aka SE) by simply clicking the button "Login with Stack Exchange". I am not asked for by SE for the SEOpenID email/password pair because it can detect that I'm already logged into SEOpenID. But if I'm not already logged into SEOpenID, then I'm being asked for the SEOpenID email/pass pair without redirecting to SEOpenID first and if I log in this way it means that now SE's got my credentials to log into SEOpenID itself, if it wanted to.

If I'm not already logged into SE, then meta.stackexchange.com (aka metaSE) will ask me for an email/password pair and seems to be no way to "log in with Stack Exchange". But if I log into SE first then refresh the browser tab with metaSE, then I'm logged into metaSE also! So no password was needed.

There are other sites which ask me for my SEOpenID email/password pair and not allow me to just click a button to be logged in with Stack Exchange, such as: stackoverflow.com askubuntu.com

This means that I have to type my email/password pair (those from the SEOpenID account!!) into those sites directly! Which means they now have the ability to log into my SEOpenID account and wherever else I'm using this account to log in.

A related question if you want to see what SEOpenID sees when I try to login to AskUbuntu (or even Stack Overflow) it's this SE owned IP 198.252.206.71 instead of my IP, as usual: Why does StackExchange itself login my OpenID account at StackExchange?

All these SE sites(apparently) are hosted on Fastly (Net Range 151.101.0.0 - 151.101.255.255) but openid.stackexchange.com is Stack Exchange, Inc. (Net Range 198.252.206.0 - 198.252.206.255)

So you see why I'd like to not give them(eg. Fastly) my SEOpenID password directly. Why can't these StackExchange sites(like askubuntu) just detect that I'm already logged into SEOpenID and just log me in that way? just like SE does.

The actual question is in the title. I don't want to give any site that's asking me to login, my SEOpenID password. But I still want to use only SEOpenID(not google/facebook) to log into them. How?

  • At some point openid.stackexchange.com is going to disappear completely (it's currently deprecated), and you'll always log in by entering your email/password on-site. You won't have the option moving forward. – animuson Aug 17 '18 at 16:49
1

You're safe to enter your email and password into the login form on stackoverflow.com, askubuntu.com, and other Q&A sites that are a part of the SE network.

We control the login mechanisms there, and since we also run the credential provider (which will eventually be converted into just email/password from OpenID)... there are no issues there.

  • What if I want to use SEOpenID(aka StackID apparently) as an OpenID to log into other non-SE sites? I mean, sure I can do that according to what openid.stackexchange.com says: Your Stack Exchange account, or StackID, is a reusable form of public identity that can be used to log in to any website that supports OpenID. To log in to sites in the Stack Exchange network: click the “Log In with Stack Exchange” button To log in to websites that support OpenID: enter the URL openid.stackexchange.com -- So, SE sites can login as me on those non-SE sites as well, in theory – user399844 Aug 19 '18 at 7:28
  • @MarcusLinsner Not sure I follow, sorry. Are you saying that someone from SE would be able to log in as you on a non-SE site? That's not possible. – Adam Lear Aug 19 '18 at 15:40
  • should be possible; but by "someone" I mean like the web/sysadmin of the SE site or whoever is in a position to capture my email/pass pair when I enter it to login into the SE site (so Fastly even), they could use it to log in as me on non-SE sites where I use SEOpenID, since the email/pass is the same as the one for SEOpenID. – user399844 Aug 20 '18 at 4:54
  • Look, example of a site that uses OpenID, where I am actually using SEOpenID to login, is: ask.fedoraproject.org EDIT: they ask me for "Please enter your OpenID url, then sign in" and I enter "openid.stackexchange.com" then I get redirected to that very url (kinda), then I login into the SEOpenID site then I get redirected to ask fedora site. – user399844 Aug 21 '18 at 3:54
  • @MarcusLinsner I know how OpenID works. :) Since we are in control of SE OpenID, we chose to simplify logging in on our Q&A sites by allowing users to enter the email/password directly instead of being redirected. All authentication is done over HTTPS, nobody is stealing your credentials here. Having said that, we are deprecating the SE OpenID provider soon. If you can add a different credential to your account on the fedora site, you should do so as soon as possible. – Adam Lear Aug 21 '18 at 18:08
  • Thanks! Btw, all this OpenID stuff is new to me, so I'm the one learning how it works here :D Cheers! – user399844 Aug 21 '18 at 19:23

You must log in to answer this question.