Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I currently have one OpenID that I use from a provider, it's something like:

http://www.example.com/miffthefox/

However, I want to be able to type the address of my personal website instead of the OpenID, yet still be able to use example.com as the OpenID provider. It seems I can do this via OpenID delegation, by adding the right meta tags to my personal home page, I can redirect it to my OpenID provider.

However, since my personal home page is public, I'm worried about other users visiting my site and grabbing my OpenID. Is this something I should be worried about?

share|improve this question
2  
It gives people just one more piece of the puzzle to hack you. I wouldn't: codinghorror.com/blog/archives/001262.html –  hyperslug Oct 5 '09 at 20:16
1  
@hyperslug, you wouldn't? but you advertise your email in your profile. It can be hacked the same way. –  John T Oct 6 '09 at 0:05
1  
@John, it depends on what's being protected by that OpenID. One's bank might be protected by SSL, yet it's unwise to post your login id + bank. –  hyperslug Oct 6 '09 at 9:04
    
someone can grab your openid details if they got access to your email. –  John T Oct 6 '09 at 10:40
1  
@John, that's true, so I also wouldn't advocate exposing an email address connected to your OpenID, which the one in my profile isn't. –  hyperslug Oct 6 '09 at 16:42

2 Answers 2

up vote 6 down vote accepted

Just ensure your OpenID has a secure password. It's as secure as anything else over https that's password protected.

share|improve this answer

Someone looking at the code of your site could then figure out that MiffTheFox uses that OpenID server. So what? You tell every web site you log into that anyway. The actual OpenID verification, as John T. says, is protected by SSL.

share|improve this answer
3  
Exactly. Everyone advertises their email all over the web, it's only protected by a password as well. –  John T Oct 5 '09 at 21:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.