Web Applications Stack Exchange is a question and answer site for power users of web applications. It only takes a minute to sign up.
Sign up to join this community
The recent hack of the Gawker network has left a question in my mind. If I had an account at Gawker, I would protect myself by changing my passwords at all the other identity providers where I use the same or a related password.
What should I be doing when my OpenID id provider is hacked?
I use this account to log in basically everywhere and I'm not at all sure how I would go about protecting myself when this account is compromised.
To make changing OpenID providers easy: set up some delegate on a domain you own. You then don't have to change all your accounts, but only need to change your own HTML.
On the Stack Overflow blog, Using Your Own URL as Your OpenID describes this, but does not include the 2.0 syntax. Like for myopenid.com, for both version 1 and 2:
<link rel="openid.server openid2.provider"
href="http://www.myopenid.com/server" />
<link rel="openid.delegate openid2.local_id"
href="http://youraccount.myopenid.com/" />
<meta http-equiv="X-XRDS-Location"
content="http://www.myopenid.com/xrds?username=youraccount.myopenid.com" />
(Alternatively: take full control yourself, and become your own OpenID provider.)
rel="openid.server openid2.provider" and rel="openid.delegate openid2.local_id"
Although it's primarily a layer of obfuscation ("security through obscurity is no security at all", etc.), http://blog.woobling.org/2009/05/your-openid-sucks.html tells you how to simply set up your own OpenID delegation through a URL of your choice. While this will not prevent someone who cracks your actual OpenID provider from making use of your credentials, it still does provide two actual benefits in that case:
1) It conceals your actual OpenID provider's identity, making it less obvious to an attacker whether you're using the compromised service or not. While this concealment is easily penetrated, it's an extra step that they'd have to go through to determine whether your account is affected, which will keep you safe from attackers making use of bulk exploits. (If everybody else's door is unlocked, even a trivial lock will keep thieves at bay.) You'd then only need to worry about attackers who are specifically targeting you.
2) If your OpenID provider is cracked, you can trivially switch your delegation at any time to a different provider who, hopefully, has not been compromised. This still leaves you vulnerable until you learn of the incident and change to the new provider, but, once you change it over, your OpenID-based accounts will once again be secure without needing to visit all of the sites you use OpenID with.
I think the user had little to do when authenticators like openid are compromised... most likely people would change their password and give up using these common authenticators...
i think for these common authenticators, a two factor authentication would most likely solve the problem (i.e. the little keychain password generators you use for bank)
...I would protect myself by changing my passwords ... where I use the same or a related password.- why wait until the horse has bolted? Don't use the same password in more than one place; use some hashing mechanism (or browser plugin, etc) to get unique pw's per site, or at the very least just add the first few letters of each site's domain (or some other modification that you'll remember!) to the end of your "normal" password to make it a little more unique on each site.index.html.