3

I just read a thread in wordpress forums regarding openid security.

Please check this url

I see stackexchange using openid connect for signup/login.

Any openid can be used here.

Don't you guys think stackexchange's openid connect has less security after reading that thread?

Or stackexchange using different mechanism?

Am i missing something?

Thanks

1 Answer 1

Reset to default
5

That thread makes it sound like trusting the e-mail being provided via OpenID was the issue, not the OpenID protocol itself. Stack Exchange sites use the OpenID identifier itself to handle logins (though we will use provided emails to find duplicate and associated accounts) so it's not really comparable.

We also don't accept email assertions from untrusted OpenID providers in any capacity, so it's a moot point.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .