Security management Toolkit
Story: OpenID at risk due to DNS flaw, warns researcher
Mitigating the fallout
While there is certainly a non-vanishing risk of some phisher posing as openid.sun.com, we have taken certain steps to make sure that our users are reasonably protected: the weak Debian-generated certificate has been replaced and revoked, and most modern browsers can check the status of certificates using OCSP (all Firefox, on by default in Firefox 3.x; IE 7 and later on Vista). In addition, we published a list of best practices for safer browsing at http://blog.beuchelt.org/2008/08/07/Some+Security+Advice+For+Our+OpenID+Users.aspx
and internally.
Going forward, we are working to migrate our OpenID service to use HTTPS-based OpenIDs exclusively. There are some obvious issues, since http://some.open.id is not the same user as https://some.open.id.
At the end of the day, the OpenID service is a research experiment. Users have been warned that the service should under no circumstances be used for transactions that require any degree of assurance. We are trying to evaluate the operational characteristics of a 'user-centric' IdP.
For a number of reasons, we can so far not recommend OpenID based services for authentication of any high-value transactions. Microsoft and some other have attempted to combine OpenID with the somewhat better security of the Information Card system, but these are changing the underlying protocols in such a way, that most of it "OpenID-ness" is benig replaced by the WS-* protocol suite of the Information Card model. Other attempts to increase the security of OpenID (such as the PAPE extensions or browser supported authentication) can help to address some of the security issues, but a number of vectors to attack the system remain wide open.
Regards,
Gerald Beuchelt
Full Talkback thread
