The recent hack of the Gawker network has left a question in my mind. If I had an account at Gawker, I would protect myself by changing my passwords at all the other identity providers where I use the same or a related password.

What should I be doing when my OpenID id provider is hacked?

I use this account to log in basically everywhere and I'm not at all sure how I would go about protecting myself when this account is compromised.

  • 1
    ...I would protect myself by changing my passwords ... where I use the same or a related password. - why wait until the horse has bolted? Don't use the same password in more than one place; use some hashing mechanism (or browser plugin, etc) to get unique pw's per site, or at the very least just add the first few letters of each site's domain (or some other modification that you'll remember!) to the end of your "normal" password to make it a little more unique on each site.
    – DMA57361
    Dec 14, 2010 at 9:12
  • 1
    I am sorry, this isn't really what I asked. I'm more interested in how you would protect yourself if your openid gets compromised, where you don't have a password per website. Dec 14, 2010 at 9:32
  • @Pieter - I realise this, which is why I made a comment not an answer; needing to change passwords because of one malicous or incompenent service is something users shouldn't need to do - and I tend to try and politely argue the counterpoint whenever it is mentioned.
    – DMA57361
    Dec 14, 2010 at 9:38
  • 2
    I have set up my tiny website with OpenID delegation, so switching OpenID providers would take just a few changes in index.html.
    – user1686
    Dec 14, 2010 at 10:21

3 Answers 3


To make changing OpenID providers easy: set up some delegate on a domain you own. You then don't have to change all your accounts, but only need to change your own HTML.

On the Stack Overflow blog, Using Your Own URL as Your OpenID describes this, but does not include the 2.0 syntax. Like for myopenid.com, for both version 1 and 2:

<link rel="openid.server openid2.provider"
  href="http://www.myopenid.com/server" />  
<link rel="openid.delegate openid2.local_id" 
  href="http://youraccount.myopenid.com/" />  
<meta http-equiv="X-XRDS-Location"  
  content="http://www.myopenid.com/xrds?username=youraccount.myopenid.com" />

(Alternatively: take full control yourself, and become your own OpenID provider.)

  • 1
    The four links can be reduced to rel="openid.server openid2.provider" and rel="openid.delegate openid2.local_id"
    – user1686
    Dec 14, 2010 at 11:14
  • Nice, @grawity. Too bad I dislike horizontal scrollbars so much, so those 2 lines still need 4 lines in the example above. ;-)
    – Arjan
    Dec 14, 2010 at 11:25
  • Also, the hosting for your personal URL with redirection could be cracked, and the redirection rewritten. Is that also a threat? Couldn't the redirection page be somehow signed with a private key/certificate (issued by a trusted CA) to prevent such an attack? Mar 21, 2013 at 22:54
  • To Stack Exchange, the redirect not being trusted apparently is enough of a threat to decide to not trust self-signed or less-known HTTPS certificates; see Why can't I use my openid with HTTPS? Why does it have to be HTTP? Is it because my HTTPS cert is from cacert?, @imz. But well, if your redirect is hacked, then your certificate might be copied from the server too...?
    – Arjan
    Mar 21, 2013 at 22:59

Although it's primarily a layer of obfuscation ("security through obscurity is no security at all", etc.), http://blog.woobling.org/2009/05/your-openid-sucks.html tells you how to simply set up your own OpenID delegation through a URL of your choice. While this will not prevent someone who cracks your actual OpenID provider from making use of your credentials, it still does provide two actual benefits in that case:

1) It conceals your actual OpenID provider's identity, making it less obvious to an attacker whether you're using the compromised service or not. While this concealment is easily penetrated, it's an extra step that they'd have to go through to determine whether your account is affected, which will keep you safe from attackers making use of bulk exploits. (If everybody else's door is unlocked, even a trivial lock will keep thieves at bay.) You'd then only need to worry about attackers who are specifically targeting you.

2) If your OpenID provider is cracked, you can trivially switch your delegation at any time to a different provider who, hopefully, has not been compromised. This still leaves you vulnerable until you learn of the incident and change to the new provider, but, once you change it over, your OpenID-based accounts will once again be secure without needing to visit all of the sites you use OpenID with.

  • Also, the hosting for your personal URL with redirection could be cracked, and the redirection rewritten. Is that also a threat? Couldn't the redirection page be somehow signed with a private key/certificate (issued by a trusted CA) to prevent such an attack? Mar 21, 2013 at 22:53

I think the user had little to do when authenticators like openid are compromised... most likely people would change their password and give up using these common authenticators...

i think for these common authenticators, a two factor authentication would most likely solve the problem (i.e. the little keychain password generators you use for bank)

  • So, then the plan would need: how to know where one used the OpenID account, and how to change that? The Stack Exchange sites allow for using multiple OpenID accounts, which also actually adds support to change the provider without creating a new account. I'm not sure how many other sites support that.
    – Arjan
    Dec 14, 2010 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.