Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
username.id.fedoraproject.org
as your openID provider.
For example, my openID url is mmcgrath.id.fedoraproject.org
-Mike
Mike McGrath wrote:
Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
username.id.fedoraproject.org
as your openID provider.
For example, my openID url is mmcgrath.id.fedoraproject.org
Cool. That works just fine.
Rahul
Mike McGrath wrote:
Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
username.id.fedoraproject.org
as your openID provider.
For example, my openID url is mmcgrath.id.fedoraproject.org
It *almost* worked for me, until an "500 Internal error" in https://admin.fedoraproject.org/accounts/openid/allow
On 2008-05-29 09:16:09 AM, Nicu Buculei wrote:
It *almost* worked for me, until an "500 Internal error" in https://admin.fedoraproject.org/accounts/openid/allow
Ah, good find. I just tried to fix a bug in that, can you try again with the same OpenID consumer and see if it works?
Thanks, Ricky
Ricky Zhou wrote:
On 2008-05-29 09:16:09 AM, Nicu Buculei wrote:
It *almost* worked for me, until an "500 Internal error" in https://admin.fedoraproject.org/accounts/openid/allow
Ah, good find. I just tried to fix a bug in that, can you try again with the same OpenID consumer and see if it works?
Yes, it works now (the consumer was blogger.com)
2008/5/29 Mike McGrath mmcgrath@redhat.com:
Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
username.id.fedoraproject.org
as your openID provider.
Works perfectly, great work all :)
Jon
On Thu May 29 2008, Mike McGrath wrote:
Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
The login to livejournal worked for me, too. But after I have seen how it works, I think it is too insecure to use the FAS password for authentication. This makes it pretty easy for any openid user to get the FAS password, because instead of really forwarding someone to the FAS homepage, one could just present the FAS login form to get the password. Here is an interesting blog article about security considerations wrt. openid: http://idcorner.org/2007/08/22/the-problems-with-openid/
Regards, Till
2008/5/29 Till Maas opensource@till.name:
On Thu May 29 2008, Mike McGrath wrote:
Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
The login to livejournal worked for me, too. But after I have seen how it works, I think it is too insecure to use the FAS password for authentication. This makes it pretty easy for any openid user to get the FAS password, because instead of really forwarding someone to the FAS homepage, one could just present the FAS login form to get the password. Here is an interesting blog article about security considerations wrt. openid: http://idcorner.org/2007/08/22/the-problems-with-openid/
While I don't have any specific replies to the issues that Stefan Brand points out in that article (I'm too new at the OpenID game), it should be noted that Stefan is the owner of a company that is developing a competing patented[1] technology that recently sold out to Microsoft[2]. However, David Recordon does have a rebuttal of Stefan's points[3].
[1] http://www.credentica.com/patent_portfolio.html [2] http://idcorner.org/2008/03/06/microsoft-acquires-credenticas-u-prove-techno... [3] http://daveman692.livejournal.com/310578.html
Jeff
On Thu, May 29, 2008 at 9:01 AM, Jeffrey Ollie jeff@ocjtech.us wrote:
2008/5/29 Till Maas opensource@till.name:
Here is an interesting blog article about security considerations wrt. openid: http://idcorner.org/2007/08/22/the-problems-with-openid/
While I don't have any specific replies to the issues that Stefan Brand points out in that article (I'm too new at the OpenID game), it should be noted that Stefan is the owner of a company that is developing a competing patented[1] technology that recently sold out to Microsoft[2]. However, David Recordon does have a rebuttal of Stefan's points[3].
[1] http://www.credentica.com/patent_portfolio.html [2] http://idcorner.org/2008/03/06/microsoft-acquires-credenticas-u-prove-techno... [3] http://daveman692.livejournal.com/310578.html
I wouldn't dismiss his comments because of who he sold his patented technology to until people on the infrastructure team more familiar with OpenID and the security risks associated with it (I'm not that person either :-) ) have reviewed the article for merit. Stefan does post a follow-up comment to the David Recordon post.
It seems people are divided on the security OpenID does or does not provide. It also seems to me an area where if OpenID is implemented there should be some people on the infrastructure team that understand the nuances of any security issues related to OpenID. We may have those people on the team already - in which case hearing their opinion on some of these articles would be useful.
The phishing problem isn't unique to OpenID.
No, it isn't unique to OpenID - but it is certainly an area we should take into account before implementing OpenID.
With all of that said - I like the OpenID idea. And we run other services that have potential exposure to security issues (ssh, just our normal FAS logins, etc) - but we do make efforts to protect those services to the best of our ability to reduce our risk. I think we should do the same with an OpenID implementation. Sure the Infrastructure team can get OpenID to work, we just need to be sure someone also makes sure we have evaluated potential security concerns and addressed them when deemed appropriate. We may already have that person on the team - or we may need to spend the time to study some of the issues pointed out and determine if they are a valid risk and if so - how do we protect against it.
~Jeffrey
Jeffrey Tadlock wrote:
The phishing problem isn't unique to OpenID.
No, it isn't unique to OpenID - but it is certainly an area we should take into account before implementing OpenID.
With all of that said - I like the OpenID idea. And we run other services that have potential exposure to security issues (ssh, just our normal FAS logins, etc) - but we do make efforts to protect those services to the best of our ability to reduce our risk.
... and we should actually look at using our SSL certs more for authentication as opposed to requiring people to type their FAS password all over the place. This is something I keep meaning to bring up but then having other stuff come up instead.
But that's neither here nor there wrt OpenID
Jeremy
On Thu, 29 May 2008, Jeremy Katz wrote:
Jeffrey Tadlock wrote:
The phishing problem isn't unique to OpenID.
No, it isn't unique to OpenID - but it is certainly an area we should take into account before implementing OpenID.
With all of that said - I like the OpenID idea. And we run other services that have potential exposure to security issues (ssh, just our normal FAS logins, etc) - but we do make efforts to protect those services to the best of our ability to reduce our risk.
... and we should actually look at using our SSL certs more for authentication as opposed to requiring people to type their FAS password all over the place. This is something I keep meaning to bring up but then having other stuff come up instead.
Actually we have some SSL auth in place already though I'm not totally sure the status of it. We haven't officially announced it I know that :)
ricky? toshio? any comments?
-Mike
On Thu, May 29, 2008 at 12:07:43PM +0200, Till Maas wrote:
On Thu May 29 2008, Mike McGrath wrote:
Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
The login to livejournal worked for me, too. But after I have seen how it works, I think it is too insecure to use the FAS password for authentication. This makes it pretty easy for any openid user to get the FAS password, because instead of really forwarding someone to the FAS homepage, one could just present the FAS login form to get the password. Here is an interesting blog article about security considerations wrt. openid: http://idcorner.org/2007/08/22/the-problems-with-openid/
A possible solution to the phishing issue might be to only allow ssl client auth and not a login/password for a.fp.org/accounts/openid/login this doesn't stop the phishing site asking for a password but the difference might be enough for the user to notice that something is wrong.
I am not sure that I see any value in OpenID in any case, there are very few OpenID consumers that I know about.
Kostas
On Thu, May 29, 2008 at 8:03 AM, Kostas Georgiou k.georgiou@imperial.ac.uk wrote:
A possible solution to the phishing issue might be to only allow ssl client auth and not a login/password for a.fp.org/accounts/openid/login this doesn't stop the phishing site asking for a password but the difference might be enough for the user to notice that something is wrong.
The phishing problem isn't unique to OpenID.
I am not sure that I see any value in OpenID in any case, there are very few OpenID consumers that I know about.
While OpenID is definitely an emerging technology, there are a lot of places where OpenID can be used to authenticate. Here are a couple of sites that have directories of OpenID-enabled sites:
https://www.myopenid.com/directory http://openiddirectory.com/
Jeff
On Thu May 29 2008, Kostas Georgiou wrote:
I am not sure that I see any value in OpenID in any case, there are very few OpenID consumers that I know about.
I would like to see many upstream bugtrackers allow ingan OpenID login, so that I do not need another new password and registration for them.
Regards, Till
Mike McGrath wrote:
Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
username.id.fedoraproject.org
as your openID provider.
For example, my openID url is mmcgrath.id.fedoraproject.org
There is any way to make the landing page of that URL prettier? People will see the URL and maybe will click on it, so is a must to have the same CSS as all our websites. In the "nice to have" category would be a little user customization, like the user can include a link to his fedorapeople.org account, link to personal blog, Fedora wiki userpage, maybe the hackergotchi image (from .planet) etc.
Works with plaxo.com. Links directly to your profile there, unlike livejournal.com.
-- Jason
Mike McGrath wrote:
Hey guys, so the last little bits are in good shape for the OpenID provider we're attempting to be. Don't go announcing this to others yet. Lets test it out, if it breaks something let us know. We'll be announcing it officially soon. You can, for example, log in to livejournal.com with:
username.id.fedoraproject.org
as your openID provider.
For example, my openID url is mmcgrath.id.fedoraproject.org
-Mike
Fedora-infrastructure-list mailing list Fedora-infrastructure-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list
infrastructure@lists.fedoraproject.org
-
Jason Watson -
Jeffrey Ollie -
Jeffrey Tadlock -
Jeremy Katz -
Jonathan Roberts -
Kostas Georgiou -
Mike McGrath -
Nicu Buculei -
Rahul Sundaram -
Ricky Zhou -
Till Maas