Is it a good idea to implement OpenID services in internal and/or customer applications?

Question

I've been discussing with my colleges about logging in by using your OpenID account, Google account etc. in our customers CMS and/or the internal systems we use, as we've had a few requests regarding this from both existing customers and new.

What are your approaches on this? Is this a bad idea? Especially for our customers, in their customized content management systems? I really think it can be a major security issue, but would a normal login, provided by us, in the reality, be as much of a security risk?

Answer 1

I think owning login credentials is a bigger security risk, at least from a political perspective. Given you don't even have passwords, you have just completely avoided having a gawker media style issue where someone penetrates your database and uses it as a launch pad because your password storage was weak.

From a traditional security perspective, you have the same potential authorization and escalation of privilege issues no matter how you are authenticating users.

Answer 2

If your clients want to do it then it definitely saves you the work and risk of implementing your own authentication and requiring users to remember yet another password. The other thing is that just because you support the OpenID protocol doesn't mean you have to accept any authentication. So perhaps your client is comfortable with Google but not Yahoo for some bizarre reason. Then you could restrict the app to only use the trusted identity registries.

I would submit that security vulnerabilities in systems are typically more common and easier to exploit in ways other than stealing login credentials. The OWASP Top Ten is a good summary of the most common issues. For example if your session management is poor then it won't really matter how the users login from a security perspective.