Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

Does OpenID expose your email address to the websites that use the service? For example, when using stackoverflow with google openID provider is my google address exposed to stackoverflow? (It seems like it is because it displays my email) Is there a way to prevent that? I thought OpenID was supposed to be private?

share|improve this question
    
This sounds more like a security or webmaster focussed question instead of power web apps users. Feel free to disagree. –  Eight Days of Malaise Jul 20 '11 at 23:24
    
I don't necessarily disagree. I had a hard time knowing which SE site to use. This proliferation of sites, while probably a good idea, is a pain sometimes. I really wanted to ask it on stackoverflow because it would have the most eyes on it. –  User Jul 21 '11 at 0:29
2  
I think this question belongs here because it deals with a question that the user or OpenID might ask rather than the developer of an OpenID application. –  Rincewind42 Jul 21 '11 at 6:03

1 Answer 1

up vote 6 down vote accepted

When you log in via OpenID, some information is given by the OpenID provider to the consumer website. The actual login part, where you type in your password, is done on the providers web page, so the consumer website doesn't know your login details. However, the OpenID provider will send to the consumer site, some of your profile details. Just what details are disclosed depends on the provider.

For example, if you sign in using your google ID, then the consumer site will be given your full name and email for a basic request. Google may also disclose your real world address and language preference. With a get_contacts call, Google would disclose your full contacts list and their email addresses (similar to when you do "Find Friends" in Facebook or similar social site.)

Some other Open ID providers will give more or less info to the consumer website. There's a nice list of what is given out by whome on this website. Facebook, MySpace and LinkedIn seem to give out the most about of info. Other providers like Twitter and paypal give out relatively less info.

share|improve this answer
    
Is Twitter an Open ID provider? I wanted to use them because based on that site it looks like they provide the least info. Plus I figure they'll be around for a while. However, in Stackoverflow there doesn't seem to be an option to use twitter as the open id provider. Also in general I can't find any info about them being a provider. –  User Jul 22 '11 at 17:53
2  
An open ID provider can only expose whatever info you have entered on the registration form. You can make a new OpenID at myopenid.com/signup using just a username and password. The email address is optional (though without one password recovery might be difficult.) If you don't enter your email and name on the OpenID provider website then it won't be made public to other sites. –  Rincewind42 Jul 23 '11 at 11:37
1  
Though Twitter isn't listed on Stackexchange websites for login, it can be used. Click on the "more options" link under the openID logos and a text box appears where you can enter the URI of the OpenID you wish to use. –  Rincewind42 Jul 23 '11 at 11:40
    
What would my twitter OpenID URI be? That's just the thing I can't seem to find any info about Twitter and OpenID together. –  User Jul 23 '11 at 19:28
    
Likewise. I googled for quite some time and came up blank. I would recommend you go with my previous suggestion, if you worry about privacy, and create a new openID that contains no personal details, and use that everywhere. –  Rincewind42 Jul 23 '11 at 22:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.