Couldn't any webapp that requires an OpenID login just secretly store my password and get access to my account(s)?
If not, why not?
Add a comment
|
3 Answers
They can't, as you only send your password to your OpenID provider. However, there is a risk that a site could send you to a fake provider that collects your password, so it is important to double-check that the URI you're on is correct before entering your password.
The whole point of open ID is that it takes you to a safe website that asks for your password (your open ID provider), which then sends only the information you allow it to the site requesting the information (e.g. email address, name, etc.).
For a detailed explanation of how it works, check out Wikipedia's article on what happens during the login process.
answered Aug 6, 2010 at 13:13
It is also important to consider the alternative. It is well known that people re-use account names and passwords on most sites. Imagine an evil site that encourages people to create accounts. A user creates an account of john_doe/xyzzy. The evil site can now go check to see if those credentials work on amazon.com, ebay.com etc. I use google as my OpenId provider and I assume google is unlikely to engage in petty theft like that, where as a random forum owner might.
