1.1k VIEWS
Pinterest LinkedIn LINE

Via an article by ZIGOROu, I came across mitani1207’s diary entry, “The Truth Is, Authentication with OpenID Is Scary”.

This is probably a fairly common reaction, so I would like to push back on it a little.

We do not know how an external site manages passwords. They might even be stored in plaintext in a database, allowing an administrator to retrieve them easily with something like SELECT * FROM USER_TABLE. This is a concern for sites that handle billing information or private data.mitani1207’s diary entry, “The Truth Is, Authentication with OpenID Is Scary”

This is not actually an issue limited to OpenID, is it? It applies to ASP services in general.

Sites that send me the password I entered when I reset my password are truly frightening. To begin with, storing information such as passwords in a decryptable form is out of the question.

It is dangerous to accept authentication from just any site.
Authentication should be accepted only from sites that securely manage IDs and passwords.
It is necessary to audit whether a site is “doing things properly.”
A self-serving audit is meaningless, so an audit by a third party is best.
Why not create something like a Privacy Mark-style “Secure ID Provider Mark”? Japanese people like that sort of thing, don’t they?

This is where reputation comes in.

When people hear “reputation,” many generally imagine something like Yahoo! Auction, but I use the term somewhat more broadly and include “audits” within its scope. However, an “audit” can speak only to the point in time when it was conducted. To take subsequent conditions into account as well, I believe it should be used together with “community ratings.”

Also, the audit criteria should not be limited to password management. In general, it would be necessary to verify the claims that the OP (IdP) makes regarding the assertions it issues. Therefore, I think the audit criteria should include at least the following:

  • Measures and operations for ensuring registration quality
  • Measures and operations for ensuring authentication quality
  • The security quality of the system as a whole

Important information such as billing information should not be authenticated using OpenID authentication alone.
Prepare a separate password managed only within your own site.

I am not so sure about that.
I think one should consider, as a whole, the management standards and operational quality for the password managed only within the site, as well as the strength of the password (and the authentication that uses it).

For example, suppose an OpenID assertion said, “Registration was performed in person using a government-issued photo ID, session authentication uses a hardware token and biometrics, and SHA256 is used for hashing,” and the OP were trustworthy. It would then be reasonable to regard its authentication quality as higher than that of most Internet commerce sites. Therefore, I think the conclusion would instead be that this OpenID authentication certificate (assertion) should take precedence over the site’s own password authentication.

Regarding the quality of such assertions, you may also wish to consult standards such as PAPE and AQE.

So, what do you think, ZIGOROu? (I toss the question over from the sidelines.)

Related posts