Web Applications Stack Exchange is a question and answer site for power users of web applications. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Couldn't any webapp that requires an OpenID login just secretly store my password and get access to my account(s)?

If not, why not?

share|improve this question
up vote 14 down vote accepted

They can't, as you only send your password to your OpenID provider. However, there is a risk that a site could send you to a fake provider that collects your password, so it is important to double-check that the URI you're on is correct before entering your password.

share|improve this answer

The whole point of open ID is that it takes you to a safe website that asks for your password (your open ID provider), which then sends only the information you allow it to the site requesting the information (e.g. email address, name, etc.).

For a detailed explanation of how it works, check out Wikipedia's article on what happens during the login process.

share|improve this answer

It is also important to consider the alternative. It is well known that people re-use account names and passwords on most sites. Imagine an evil site that encourages people to create accounts. A user creates an account of john_doe/xyzzy. The evil site can now go check to see if those credentials work on amazon.com, ebay.com etc. I use google as my OpenId provider and I assume google is unlikely to engage in petty theft like that, where as a random forum owner might.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.