myVidoop passes the ‘fun’ security test
Fun Communications made a neat little site http://idtheft.fun.de/ that lets you mount a man-in-the-middle based phishing attack against your OpenID provider of choice. It is useful for testing and we would suggest people check out their own provider, the results may be interesting. Mike Jones used the site to check out a couple providers and posted his results.
Vidoop is happy to report our OpenID provider myVidoop was not phishable. There are a number of things we do to prevent phishing including requiring browser activation, use of the ImageShield itself, etc. In this case the attempt likely failed because Fun’s site was not able to mimic the JavaScript code and/or the ImageShield was unable to be scraped. You also would have been protected if you use our browser plug-in (IE and FF versions available) for logging in to myVidoop. Though we aren’t patting ourselves on the back quite yet. There is still much work to be done to make things even more secure with myVidoop and OpenID. As Michael Graves points out in a comment on Mike’s post:
…the “webness” of OpenID also means it inherits many of the weaknesses of the web, and the vulnerability to phishing attacks is one of those weaknesses…
This has naturally led to discussion about the vulnerabilities of OpenID and what is being done to address these issues. The answers are out there in the form of PAPE, a protocol that lets OpenID providers assert what level of phishing protection they offer. OpenID providers like Vidoop and Verisign need to keep adding levels of security on top of basic OpenID authentication. Continued education efforts and improvements in usability will also help OpenID to keep growing at a rapid pace.