Couldn't any webapp that requires an OpenID login just secretly store my password and get access to my account(s)?

If not, why not?

3 Answers 3


They can't, as you only send your password to your OpenID provider. However, there is a risk that a site could send you to a fake provider that collects your password, so it is important to double-check that the URI you're on is correct before entering your password.


The whole point of open ID is that it takes you to a safe website that asks for your password (your open ID provider), which then sends only the information you allow it to the site requesting the information (e.g. email address, name, etc.).

For a detailed explanation of how it works, check out Wikipedia's article on what happens during the login process.


It is also important to consider the alternative. It is well known that people re-use account names and passwords on most sites. Imagine an evil site that encourages people to create accounts. A user creates an account of john_doe/xyzzy. The evil site can now go check to see if those credentials work on amazon.com, ebay.com etc. I use google as my OpenId provider and I assume google is unlikely to engage in petty theft like that, where as a random forum owner might.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.