Later archive addition
OpenID association poisoning
Describes a possible OpenID association-store flaw: a malicious provider chooses another provider’s association handle and replaces its shared secret. A relying party that indexes associations incorrectly could reject legitimate logins or accept forged identities. The author checks DotNetOpenId and Janrain’s Ruby library and finds neither vulnerable to this proposed attack.
Record
- Researcher
- Andrew Arnott
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Andrew Arnott, first published at the original source. Preserved copies are kept so the citation survives its host.