One weakness of OpenID is the problem of phishing. With OpenID, users are redirected to an authentication server for authentication. The problem is that, instead of being sent to the legitimate site, they can be redirected to a phishing site where their ID and password are stolen.
Microsoft and VeriSign are working together on a CardSpace-based solution to this problem, but two-factor authentication using a bookmark has also been proposed as a far more lightweight approach. A notable example is BeamAuth.
To use BeamAuth, the user first installs a bookmark from a page that has been verified as legitimate, like the following one.
http://beamauth.org/login#ben@adida.net|8b7c8xcv882340235098142308
In the example above, http://beamauth.org/login is the OpenID Assertion Provider URL. In other words, when users try to log in to a Relying Party site, they are normally redirected here and enter their username and password.
When using BeamAuth, however, the user clicks this bookmark instead of entering a username and password at this point. Take a close look at the bookmark above. A string beginning with # has been appended to the Assertion Provider URL. In URL terminology, this is called a fragment. When the user clicks the bookmark while on the legitimate site, the browser does not actually retrieve the data again; it updates only the URL field. The page itself is therefore not refreshed, but JavaScript on that page can access the URL fragment. The JavaScript retrieves the URL fragment, uses it as a key to calculate an HMAC, and sends the HMAC to the server together with the username and password entered by the user. The server is configured not to authenticate the user without this HMAC.
If the user is on the wrong site—a phishing site—the bookmark instead redirects the user to the legitimate site.
In other words, this approach attempts to prevent phishing in 2 ways.
(1) Once users develop the habit of authenticating by clicking the bookmark, they will no longer enter their information on phishing sites.
(2) Even if a user is deceived into entering a password on a phishing site, the phishing site cannot obtain the HMAC described above. It therefore cannot have an Assertion issued and, as a result, cannot use the Relying Party’s service.
Although this approach requires some modifications to the OpenID Server, the client needs only a browser, so it can be considered a fairly lightweight solution.
More details are available in English on Benlog. There are also links to demo sites, so please give it a try.
Having written this far, however, something occurred to me.
This makes things better, but phishing is still possible.
A phisher could, for example, use JavaScript to steal the bookmark. It would probably still need to be combined with something like PassMark. In that case, is this actually useful???