Web Hack List

Collected research

OpenID association poisoning

Describes a possible OpenID association-store flaw: a malicious provider chooses another provider’s association handle and replaces its shared secret. A relying party that indexes associations incorrectly could reject legitimate logins or accept forged identities. The author checks DotNetOpenId and Janrain’s Ruby library and finds neither vulnerable to this proposed attack.

Record

Researcher
Andrew Arnott
Published by
blog.nerdbank.net
Topic
Other

In the archive

Tags

This page is the archive's own catalogue record. The research is the work of Andrew Arnott, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .