|visits||member for||3 years, 11 months|
|seen||Nov 4 at 0:35|
Is OpenID this easy to hack or am I missing something?
I know this old but, knowing the openid "id" is useless...google for example uses the exact same url for exery single user. How does knowing that help you login to stackoverflow as me (other than knowing that if you can hack my google account you can be authenticated as me, but that's no different from "forgot username/password").
Our security auditor is an idiot. How do I give him the information he wants?
Not a high rep user, but my personal feeling for your answer is: give my password to a third party and I'll see if I can't sue. As someone in the IT field, I'd agree with the high rep users you mention and say that you aren't supposed to store a password. The user is trusting your system, giving their password to a third party is a violation of that trust more extreme than giving all of their information to someone. As a professional I would never do that.