Secure OpenID user authentication

0
votes

My goal is a secure login in system such as stackoverflow uses. I am a newbie but as you have probably seen I have spent all day looking up stackoverflow articles on security. As a result of this research I have now worked out a plan of attack. In particular this page was a great help Using OpenID for website Authentication. Can you please tell me if the following system would be a secure system and if not how should I improve the system.

  1. Use OpenID to validate users.

  2. Once a user has been validated by OpenID get user's email address from OpenID.

  3. Hash the email address and store in session variable.

  4. Compare Hashed email address to list of hashed email addresses in databases

  5. Return content appropriate to that user based on the hashed email address.

In particular I am nervous about using the email address instead of the ProviderOpenID.

Please assume that I have (as I have found answers to these questions on other stackoverflow pages):

  1. Properly destroyed sessions after use.

  2. Setup my server to store session data in an inaccessible location.

  3. Setup my database in a secure manner.

  4. I am using SSL to ensure traffic cannot be intercepted.

Thanks in advance.

1
securityauthenticationopenid

1 Answers

1
votes

In general, your way better of using some authentication architecture for the language you are using that supports OpenID. Not only is it more secure, its just easier, you write less code, and you don't have to maintain that code or test it. There are ones for PHP,python,c#/asp.net, rails. A lot of frameworks also have support.

First, why not use the provided ID ?

I think you have two problems:

  1. Its possible that an openID provider could return a email address for a different domain than the provider's.

    For example, gmail could authenticate me correctly but I could specify that my email address was [email protected]. Then you would read my identity as me being Bill Gates despite the fact that it is not. There are of course ways to prevent this, but the standard system probably has safeguards included and even if it doesn't, it is someone else's responsibility to fix them and other people will be looking at those issues.

  2. If I am reading the wikipedia article correctly, openID id's are not necessarily email addresses

    This is not a security problem , but it does break expected behavior.