<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head>
<body>
<div style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif">It seems to me that any RP that accepts Google Profiles logins right now has significant security flaws because they are not validating that the asserting OP Endpoint has authority to assert for the claimed_id.<br>
<br>Sent from my Windows Phone</div>
<hr>
<span style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma,sans-serif">From: </span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma,sans-serif">Johannes Ernst</span><br><span style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma,sans-serif">Sent: </span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma,sans-serif">Sunday, July 03, 2011 11:31 AM</span><br>
<span style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma,sans-serif">To: </span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma,sans-serif"><a href="mailto:openid-general@lists.openid.net">openid-general@lists.openid.net</a></span><br>
<span style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma,sans-serif">Subject: </span><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma,sans-serif">[OpenID] More G+ weird behavior. Was: Google+ and Unique Identifiers -- different again?</span><br>
<br></body></html><html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">On the first login, I specify<div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://profiles.google.com/Johannes.Ernst">http://profiles.google.com/Johannes.Ernst</a></div>
<div>which logs me in after having been automagically transformed into<br><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://plus.google.com/104555285104903729468">https://plus.google.com/104555285104903729468</a></div>
<div>per previous message.</div><div><br></div><div>Then, the next day, (because my session cookie is expired), I try to re-login with the apparently canonical identifier</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://plus.google.com/104555285104903729468">https://plus.google.com/104555285104903729468</a></div>
<div>which leads me to a Google page at</div><div><span class="Apple-tab-span" style="white-space:pre"> <a href="https://accounts.google.com/o/openid2/ProfileCreation">https://accounts.google.com/o/openid2/ProfileCreation</a></span></div>
<div><span class="Apple-tab-span" style="white-space:pre">t</span>hat says</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><relying party URL> i<span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; ">s asking for your Google profile, but you don't have one yet</span></div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; ">and only gives me the option to cancel or "create a Google profile now". Trouble is, I already have a Google profile, and even adding to it does not let me proceed from that page.</span></div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; "><br></span></div><div><font class="Apple-style-span" face="arial, sans-serif" size="3"><span class="Apple-style-span" style="font-size: 13px;">So I cancel that attempt, and try again with</span></font></div>
<div><font class="Apple-style-span" face="arial, sans-serif" size="3"><span class="Apple-style-span" style="font-size: 13px;"><div style="font-family: Helvetica; font-size: medium; "><span class="Apple-tab-span" style="white-space: pre; "> </span><a href="http://profiles.google.com/Johannes.Ernst">http://profiles.google.com/Johannes.Ernst</a></div>
<div>which works like a charm -- except that I'm </div></span></font></div><div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; "><span class="Apple-style-span" style="font-family: Helvetica; font-size: medium; "><span class="Apple-tab-span" style="white-space: pre; "> </span></span><span class="Apple-style-span" style="font-family: Helvetica; font-size: medium; "><a href="https://plus.google.com/104555285104903729468">https://plus.google.com/104555285104903729468</a></span></span></div>
<div><span class="Apple-style-span" style="font-family: arial, sans-serif; font-size: 13px; "><span class="Apple-style-span" style="font-family: Helvetica; font-size: medium; ">again.</span></span></div><div><br></div><div>
<br></div><div>On Jul 1, 2011, at 20:48, Johannes Ernst wrote:</div><div><div><br class="Apple-interchange-newline"><blockquote type="cite"><div>It seems Google has changed their unique identifiers for people again. <br><br>
Apparently I'm now:<br><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://plus.google.com/104555285104903729468">https://plus.google.com/104555285104903729468</a><br>as opposed to<br><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://profiles.google.com/Johannes.Ernst">http://profiles.google.com/Johannes.Ernst</a><br>
and so many other variations over the years.<br><br>My relying party implementation does not recognize me any more although I use the same URL as identifier. Which means I can't access my account!<br><br>Is it me who is doing something wrong here? What's the official Google migration path?<br>
<br>Thanks,<br><br><br><br>Johannes.<br><br>_______________________________________________<br>general mailing list<br><a href="mailto:general@lists.openid.net">general@lists.openid.net</a><br><a href="http://lists.openid.net/mailman/listinfo/openid-general">http://lists.openid.net/mailman/listinfo/openid-general</a><br>
</div></blockquote></div><br></div></div></body></html>