Is there an incremental security risk to using delegated login systems? [closed]

Question

superuser.com, other stackexchange websites, and many more websites offer a form of login that allows a Gmail account user to login with one click.

Does the use of such a feature expose the user to an incremental security risk above the level inherent in the use of Gmail and "native" superuser.com login.

Answer 1

At least in certain circumstances, yes. If you would normally use different passwords for the two different sites, centralising your login onto one of the sites reduces security, because an attacker who gains access to your single password can now access your accounts on both sites. That's pretty obvious.

A closely related issue: I personally don't use different passwords for every website, but I do try and classify websites by how important it is to secure my access to them. It's easy to remember to use a different password or passphrase for your bank website and for your "pictures of cats" blog. What might trip people up is if bank websites (or other websites which people really really want to prevent other people gaining access to) used OAuth or similar single sign-on techniques - people might just assume that everything is secure, and forget that they still need a strong password for whichever site they are ultimately providing a password to.

"Bank websites" is kind of a silly example (I hope!) but you get the idea.

Answer 2

The open id give you the ability to login with one central username and password.

Site like superuser make a default user for you (basicly a u + number) once you tell them "hey i want to use my google id." They ask your permission to retrieve the fields they need from your google id. They do not save your google password since the api works with tokens to confirm things

Lower or higher security risk? I would say lower based on the following People use the same password over and over. http://www.readwriteweb.com/archives/majority_use_same_password.php

This is not recommend by most security guidelines because a hacker could obtain access by hacking an external database. with all password and user information on one central place the attackers only have one place to attack and the defenders only one place to defend.

Like most things with security this advantage has its desadvantage

But there are also a number of potential problems. Chief among them, in my mind, is that unifying your online identities means that having your password compromised becomes a whole lot like losing your wallet. Now instead of some unscrupulous individual gaining access one online account, the person who has your OpenID credentials can log in everywhere you do. Recovering from that means a long, slow process (for record, I haven't heard anyone talk about using OpenID for logging into ultra-sensitive web sites like those for banking or managing credit cards).

The main reason (in my opinion) to use openID is usability

Do you want to complete a registration form for the 10000000 times or just reuse the same information?