Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: OpenID. The future of authentication on the web?
From: "John C. A. Bambenek, GCIH, CISSP" <bambenek.infosec () gmail com>
Date: Mon, 24 Mar 2008 10:02:15 -0500

For the automated low-hanging fruit attacks, they won't crack.  They're
simply trawling for passwords and rarely do they even think to cross-check.
For someone to spend the kind of thought and attention the victim has to be
specifically targetted.

Now, to be fair, I only advocate that strategy for "throwaway" accounts.
For instance, I don't really care if my account on digg gets cracked, I do
care if my bank account gets cracked.  So I use the throwaway for digg (or
other sites that just don't matter if they are compromised) and something
secure and unique for the banks and other important stuff.

The alternative is that someone uses the same password for EVERYTHING, crack
some forum and you've got bank account passwords too.

Long winded, but I'm not sure much OpenID would provide authentication for
I'd care about (admittedly I haven't looked in detail).

On Mon, Mar 24, 2008 at 9:58 AM, Larry Seltzer <Larry () larryseltzer com>

 >>For instance, S0m3p4ss!### where ### is a 3-letter acronym for the site
they are accessing.  Still need only one password to remember and you don't
necessarily have a single point of 0wnership anymore.
I've never understood this strategy. Once I compromise your "S0m3p4ss!ama"
password for amazon.com how long will it take me to figure out all your

Larry Seltzer
eWEEK.com Security Center Editor
*http://security.eweek.com/* <http://security.eweek.com/>
** <http://blogs.pcmag.com/securitywatch/>*
Contributing Editor, PC Magazine
larry.seltzer () ziffdavisenterprise com

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]