3

I'm making a web application where users can log in with Open ID and create their own profile on the website, so I was trying some things on stackoverflow. Now I wonder if the following is a bug or a 'feature'.

  • My SO account was created using my gmail account, so it appears in my profile (optional email) and in "my logins".
  • I changed my profile's optional email address to be my yahoo address.
  • Opened a new incognito window, clicked Log in and identified with my yahoo email address (which is NOT in my SO account's "my logins")
  • "This log in is new to stackoverflow, confirm create account ..." I clicked ok, and now I was signed in with my SO profile that is only associated with my gmail account in "my logins"

So either it's "smart" because if I changed my profile's optional email that proves that I own this email account and therefore I can link my SO account with it, even though I didn't explicitly added it to "my logins". Or it's just dangerous.

I was actually wondering what to do in this case. It seems this could be exploited further. But at the same time you don't want to mix things up and have a new SO user who has an open id login/email that is actually the same as the optional email address (profile) of another SO user. Because then what do you do when he wants to reset his password or do whatever that will send him an email notification?

Hopefully this question can help confirm that all this is secure and well thought and in any case give me advice for my personal project.

1 Answer 1

3

Yeah, Data Explorer's authentication scheme does this as well, and I'm not a particularly huge fan of relying on user input for this case – even if it occasionally helps prevent unintentional account duplication. That said, as long as no unauthorized changes can be made to a registered user's profile, the potential for exploit isn't really a concern.

Stack Exchange only trusts a handful of well-established OpenID providers to return reliable values for user email, so you can't, for example, create a malicious OpenID provider that would give you access to another user's account. Likewise, since you can't modify the value of another user's email field (the form being XSRF-protected), you can't practically set up an email on one of those trusted providers that would give you access either.

11
  • What disturbs me is that I added a an arbitrary yahoo account to my stackoverflow account, without going to "my logins", being redirected to yahoo and entering my password there. And if this is normal, then what's the point of asking to log in with the yahoo account from "my logins".
    – Romz
    Nov 18, 2012 at 0:05
  • But you had to have access to your account from your registered Gmail login to set the email that allowed you to log in with your authenticated Yahoo OpenID provider in the first place, so the association wasn't arbitrary.
    – Tim Stone
    Nov 18, 2012 at 0:08
  • That's very true. But from "my logins" why ask for a login/password if you want to add your yahoo account then? You could let the user simply type in his email address, right? (just like in his profile page) I just don't understand why in one case you have to type in your password and in another you can just type in the email address.
    – Romz
    Nov 18, 2012 at 0:14
  • I'm not sure I follow what you're asking. You authenticated against the Yahoo OpenID provider in the second case, Stack Overflow just associated that authentication against your existing account based on the verified email information returned during that process.
    – Tim Stone
    Nov 18, 2012 at 0:20
  • Alright, if you go to my logins and you want to add a yahoo account linked to you stackoverflow account, you click on the yahoo logo and you type in your yahoo email address and your password, then get redirected to you profile page. But, you can also add it by simply changing the optional email address of your profile (which doesn't redirect you anywhere, and doesn't ask you for a password whatsoever). So yes, in both cases you have to log in using that yahoo account in order to ACCESS your SO account, but why in the 2nd case you didn't have to enter your yahoo passwword to LINK your account?
    – Romz
    Nov 18, 2012 at 2:35
  • So if LOGGING IN with that yahoo account to access my SO account proves that I'm the owner, then why does the My Logins page force you to log in with that yahoo account with the yahoo password at the time you actually just ADD it?
    – Romz
    Nov 18, 2012 at 2:40
  • The linking didn't actually happen until you got to the "This log in is new to stackoverflow, confirm create account..." step, where the authentication system realised that you had a preexisting account and linked the OpenID you were trying to create a new account with with that one instead. In both cases, you have to prove two things: You own the SO account, and you own the OpenID. Since you authenticated against an OpenID provider both times, the second part is taken care of.
    – Tim Stone
    Nov 18, 2012 at 2:54
  • Obviously in the normal "add a login scenario", you're already logged in, so part one is easy there too. In the case you're describing, the fact that the OpenID provider returns a trusted value for email that can be compared to the user-entered value is proof enough that you own that particular account.
    – Tim Stone
    Nov 18, 2012 at 2:55
  • The obvious flaw is that you set the email to one from a trusted email provider that you don't actually own, which is why I personally don't like the approach. But, you can't exploit that very usefully.
    – Tim Stone
    Nov 18, 2012 at 2:57
  • As for "Stack Exchange only trusts a handful of well-established OpenID providers to return reliable values for user email" -- are you saying SE ignores addresses provided by others? Just to be sure: SE certainly allows any OpenID provider for logging in, and even for my self-hosted OpenID asks for email if available: &openid.alias3.if_available=alias1,alias2,alias3,alias4 [...] &openid.alias3.type.alias2=http://schema.openid.net/contact/email [...] &openid.alias3.type.alias4=http://axschema.org/contact/email. But you might be right about only using email addresses from a few of them.
    – Arjan
    Nov 18, 2012 at 8:07
  • @Arjan It might use the return value to populate the field in the profile on initial registration, but right, I was just saying that for the auto-linking case, it only trusts the return from providers that are known not to return fake values. In the general case there's no difference between any given providers.
    – Tim Stone
    Nov 18, 2012 at 8:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .