John Bradley wrote:
There is also nothing to stop the OP from checking the referrer, if
the referring site is different from the return_to that is suspicious.
The primary attack vector for phishing tends to be IM, so there would be
no referrer.
If his is used on a web site it seems like a lot of trouble to go to.
They are all ready on a bad site.
Another attack vector could be a message board, which isn't necessarily
a malicious message board controlled by the attacker. The scenario is
that the attacker posts a link on the message board saying "check out my
photos, click here to continue" and the victim examines the link and
trusts the OP's domain. The OP then redirects to the attacker's site.
As I said earlier, this scenario isnt' really that much different than
TinyURLs.
I will throw in signed requests again because I have been asked why
openID doesn't support that by some large potential RPs.
Requiring the RP to sign the request using a shared secret would be more
consistent with other auth protocols, however it would probably require
the RP to pre-register with each OP. This breaks a lot of the
autoconfiguration/autodiscovery features of OpenID.
Thanks
Allen
_______________________________________________
security mailing list
[email protected]
http://openid.net/mailman/listinfo/security
