2

Lets say I have a website which handles your money in some way. So I know about your credit cards.

Currently, user register using their national identification number. So all the users are real people registered in the country. There is a verification process.

Adding Facebook and Google+ login into the site will make it easier to login. But Im worried that new people wont register because the site would then feel insecure. Or even an increase in user removal.

Why I think Facebook and Google login may cause this is related to the recent action by NSA. And believe it or not Facebook and Google among others have lost the peoples trust in the country I live in. They use it frequently but deep inside there is no 'secure feeling' as they used to have.

So writing the title again:

  1. May Facebook and Google+ login make a site feel 'insecure'? In which situations should one avoid using external login providers?
| improve this question | |
1

Using an OpenID login is less secure. You can't verify the identity of a person directly--you have to entrust a 3rd party to connect their validation of a user to an account your site is in charge of.

And if the open ID account becomes compromised, so to does the data you are storing on their behalf.

On the other hand, it is more convenient. So there's a pro/con balance here.

Ideally, you'd maybe offer it as an option. Register an account with us or sign in with your Google/Facebook account...

| improve this answer | |
  • I would not say it using OpenID is less secure. In fact, quite the opposite. Yes, when an OpenID gets compromised, a hacker can gain access to all sites where the same account was used to register. Not using OpenID though leads to sites implementing their own DYI login and password handling and leads to users re-using user names and passwords. When one site is compromised an attacker again gains access to all sites where the same user name and password were used. ... continued ... – Marjan Venema Oct 9 '13 at 7:25
  • ... continued ... So using OpenID or DYI login poses the same threat when compromised. However, I would prefer using an OpenID login over a site's DYI login procedure because most OpenID providers are far more security aware and can spend more time and effort towards keeping your credentials secury than any single site's DYI efforts can. – Marjan Venema Oct 9 '13 at 7:25
  • @MarjanVenema whether it's one openID or one password shared, it's the same end-result. So that's kind of a moot issue. What OpenID does, though, is pass the responsibility of validating the user to a 3rd party. That's always going to be seen as less than ideal from a security standpoint, even if just a little. In the end, though, the convenience of OpenID usually wins out. – DA01 Oct 9 '13 at 14:47
  • I would say it depends on the OpenID provider. If you choose Facebook then yes account confirmation may be perfect, but account holder identity is questionable. An OpenID provider that uses physical checks (confirming physical address, state issued ID etc.) would probably be more secure than what you can do yourself. For example DigiD is an identity provider used by all levels of government in the Netherlands. Of course and unfortunately it isn't an OpenID provider, but if an OpenID provider would provide the same level of checks... (don't know if there already is one though). – Marjan Venema Oct 9 '13 at 17:49
  • @MarjanVenema generically speaking, letting a 3rd party handle user verification is seen as less secure as not going through a 3rd party. However, in terms of specifics, yes, you are right...one has to weigh the specific security of a 3rd party OpenID verification model vs. the verification model you may be using in house. Google OpenID is likely more secure than Bob's Fish Food Store Dot Com's implementation. That said, your bank's verification system is likely better than using Bob's Fish Food Store Dot Com's Open ID. :) – DA01 Oct 9 '13 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy