5

For example, when using Stack Overflow with Google openID provider is my Google address exposed to Stack Overflow?

(It seems like it is because it displays my email.)

Is there a way to prevent that?

I thought OpenID was supposed to be private?

Improve this question
3
  • This sounds more like a security or webmaster focussed question instead of power web apps users. Feel free to disagree.
    – Eight Days of Malaise
    Jul 20, 2011 at 23:24
  • I don't necessarily disagree. I had a hard time knowing which SE site to use. This proliferation of sites, while probably a good idea, is a pain sometimes. I really wanted to ask it on stackoverflow because it would have the most eyes on it.
    – User
    Jul 21, 2011 at 0:29
  • 2
    I think this question belongs here because it deals with a question that the user or OpenID might ask rather than the developer of an OpenID application.
    – Rincewind42
    Jul 21, 2011 at 6:03

1 Answer 1

Reset to default
5

When you log in via OpenID, some information is given by the OpenID provider to the consumer website. The actual login part, where you type in your password, is done on the providers web page, so the consumer website doesn't know your login details. However, the OpenID provider will send to the consumer site, some of your profile details. Just what details are disclosed depends on the provider.

For example, if you sign in using your google ID, then the consumer site will be given your full name and email for a basic request. Google may also disclose your real world address and language preference. With a get_contacts call, Google would disclose your full contacts list and their email addresses (similar to when you do "Find Friends" in Facebook or similar social site.)

Some other Open ID providers will give more or less info to the consumer website. There's a nice list of what is given out by whome on this website. Facebook, MySpace and LinkedIn seem to give out the most about of info. Other providers like Twitter and paypal give out relatively less info.

Improve this answer
7
  • Is Twitter an Open ID provider? I wanted to use them because based on that site it looks like they provide the least info. Plus I figure they'll be around for a while. However, in Stackoverflow there doesn't seem to be an option to use twitter as the open id provider. Also in general I can't find any info about them being a provider.
    – User
    Jul 22, 2011 at 17:53
  • 2
    An open ID provider can only expose whatever info you have entered on the registration form. You can make a new OpenID at myopenid.com/signup using just a username and password. The email address is optional (though without one password recovery might be difficult.) If you don't enter your email and name on the OpenID provider website then it won't be made public to other sites.
    – Rincewind42
    Jul 23, 2011 at 11:37
  • 1
    Though Twitter isn't listed on Stackexchange websites for login, it can be used. Click on the "more options" link under the openID logos and a text box appears where you can enter the URI of the OpenID you wish to use.
    – Rincewind42
    Jul 23, 2011 at 11:40
  • What would my twitter OpenID URI be? That's just the thing I can't seem to find any info about Twitter and OpenID together.
    – User
    Jul 23, 2011 at 19:28
  • Likewise. I googled for quite some time and came up blank. I would recommend you go with my previous suggestion, if you worry about privacy, and create a new openID that contains no personal details, and use that everywhere.
    – Rincewind42
    Jul 23, 2011 at 22:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.