Cyber Security Exam Prep : Open ID

Brian Hughes

Open ID: Key points to remember for the exam

  1. Initially introduced in 2005, Open ID enables Single Sign On using a centralized identity provider.
  2. With Open ID, you can create a single account with an ID and Password with an Identity Provider and then that provider confirms your identity at each place you have to authenticate by proving your identity.
  3.  In this mechanism, no other website ever gets to view your login credential except the identity provider itself.
  4. However, nowadays, Open ID has become obsolete and OAuth and Open ID connect are the new popular standards of the day,
  5. It is decentralized in nature unlike OAuth that provides centralized authorization.
  6. In order to get an Open ID, the end-user needs to get himself registered with an Open ID Service provider.
  7. Open ID was implemented in various tech giants like Google, Yahoo, Paypal, Zoho etc.
  8. However, in due course of time, various security issues were reported in Open ID technology leading to its subsequent downfall. Attacks like “Data Type Confusion Logic Flaw”, Open ID request forgery, phishing and privacy issues were reported leading to vulnerable implementations.

Cyber Security Exam Prep: Identity and Access Management – Security Assertion Markup Language (SAML)

Open ID Workflow with Example:

  1. A user wants to access his web account on a given website, say example.com.
  2. When he tried logging into example.com, the website asks the user to enter his Open ID.
  3. The user enters the Open ID that he has previously received by registering himself with an Open ID Service Provider.
  4. The website example.com then redirects the user to the Identity Provider say Google.
  5.  The user now authenticates himself to the open ID provider and upon successful authentication gets redirected to example.com
  6. Now the user can successfully browse through the authenticated session on example.com.

Cyber Security Exam Prep: Open Authentication (OAuth)

Benefits of Open ID

  1. It eliminates the need for users to remember multiple login credentials for each web resource. Instead, a single pair of login credentials, enable access to multiple unrelated web resources.
  2. Reduces the overhead of providing and maintaining their own ad hoc login systems by individual web service providers.

Related posts

Leave a Comment