611 VIEWS
Pinterest LinkedIn LINE

“Following the OpenSSL vulnerability ‘Heartbleed,’ another 1 major vulnerability has been found in popular open-source security software. This time, the vulnerability was found in the login tools ‘OAuth’ and ‘OpenID’, which are used by numerous websites and technology giants such as Google, Facebook, Microsoft, and LinkedIn.” (Source: OAuth and OpenID may have serious vulnerability—potential impact on major sites including Facebook)

Come on…. After the English CNET article appeared, ZDNet, Mashable, and others quickly published articles criticizing it. When the Japanese version did not appear for days, I thought, “Ah, CNET Japan has some good sense.” It turns out they were simply off for Golden Week. I see. orz

Since the original article is like that, naturally the translated article is too, but there are simply too many things to object to. The English version has a comments section and has been thoroughly criticized there, but the Japanese version does not, so ordinary readers will probably have no way to tell just how bad the article is.

First, neither OAuth nor OpenID is a “tool” like OpenSSL. They are standards or protocols; in the OpenSSL world, the equivalent would be TLS. Heartbleed is a problem with one implementation, OpenSSL, not a problem with TLS. Similarly, Covert Redirect is a problem with implementations of OAuth and OpenID, not a problem with the standards. Writing about an implementation problem as though it were a problem with the standards can fairly be called making a mountain out of a molehill.

Next, the article says the issue was “discovered,” but this is a well-known problem called an open redirector that has been known for more than 6 years, and websites should of course already have safeguards against it. In other words: why bring this up now? Microsoft’s statement that “our investigation has determined that the vulnerability exists in third-party domains and does not exist on our own site” probably refers to this point. Of course, this is not the only safeguard websites need to implement.

It is also important to note that Google’s implementation cited as vulnerable is its implementation of OpenID Authentication 2.0, not OpenID Connect, which is discussed together with OAuth [1].

The worst thing about this series of articles, however, is that it treats a risk not remotely comparable to Heartbleed as though it were. If people cry “wolf” again immediately after the Heartbleed wolf appeared, it will cause a stir at first. But if it repeatedly turns out not to be true, people will stop reacting to the news.

Then, when the real wolf comes, it will be too late.

It cannot be helped if an individual blog makes sensational claims [2]. But I would like mass media outlets such as CNET to recognize their responsibility as mass media, verify the facts properly, and only then report them.

For those interested, I have summarized the risks of and countermeasures for “Covert Redirect” here, though the article is in English.

 

[1] Incidentally, Google’s implementation of OpenID Authentication 2.0 does not appear to implement RP Discovery from Chapter 13.

[2] Many experts have expressed discomfort with the use of the same marketing tactics as Heartbleed.

Related posts