<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
1) The user does NOT want to sign into the site specified by the
return_to<br>
2) We don't know that the authentication request originated from that
site<br>
3) The OpenID 2.0 spec does not require OPs to send a negative
assertion.<br>
<br>
So why would we want to send the user there?<br>
<br>
Allen<br>
<br>
Max Metral wrote:
<blockquote
cite="mid:E9DD5BE59E84CA4E87AE0E5E6F1B8B12381EA9@sbsrv.AALabs.local"
type="cite">
<pre wrap="">This all sounds perfect, so in that case I would assume you could
confidently send them back to the return_url.
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:general-bounces@openid.net">general-bounces@openid.net</a> [<a class="moz-txt-link-freetext" href="mailto:general-bounces@openid.net">mailto:general-bounces@openid.net</a>] On
Behalf Of Allen Tom
Sent: Friday, April 18, 2008 9:40 PM
To: SitG Admin; <a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a>
Subject: Re: [OpenID] Yahoo hijacking?
The HTTP Referrer header, just like all other HTTP headers, can never be
trusted.
Currently, the Yahoo OP does not consider the client's HTTP Referrer
header when servicing OpenID Authentication requests.
Yahoo does try to verify that the return_to matches the realm by
performing Yadis discovery on the realm in the request. If the return_to
does not match the XRDS doc that we found through discovery, we'll
display a really ugly warning that the RP cannot verified.
This realm discovery feature was added to patch a security hole in
OpenID 1.1, and is one of the main reasons why Yahoo does not support
OpenID 1. More details here:
<a class="moz-txt-link-freetext" href="http://openid.net/pipermail/security/2007-February/000241.html">http://openid.net/pipermail/security/2007-February/000241.html</a>
Allen
SitG Admin wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">And where should we send the user? The openid.return_to value is not
necessarily the referrer,
</pre>
</blockquote>
<pre wrap="">Quick question - what if the user is blocking the referer? Using a
privacy/anonymizing plugin, etcetera? At that point the
openid.return_to value is practically *guaranteed* not to match the
referer. Is the user losing any security by blocking the referer?
-Shade
</pre>
</blockquote>
<pre wrap=""><!---->
_______________________________________________
general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</a>
</pre>
</blockquote>
<br>
</body>
</html>