Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I honestly can't remember what I used to login to Ubuntu Forums, but I am quite sure it was OpenID. Should I be concerned?

share|improve this question
4  
OT close voter(s): This question is definitely on-topic; we help people with Ubuntu community resources here ("Services provided by Ubuntu"). Furthermore, it does not belong on meta, which is only for questions about Ask Ubuntu itself (not about other Ubuntu-related sites). It might be considered a duplicate of this earlier question though. If we close either of these as a duplicate of the other I recommend merging their answers. –  Eliah Kagan Jul 25 '13 at 4:40
    
About merging answers: I had seen the other question but did not know if that applied to my case, to be honest. –  georgebrindeiro Jul 25 '13 at 16:03

4 Answers 4

up vote 15 down vote accepted

Since OpenID login is always processed on the issuer side (for example, if you use OpenID you got from Launchpad, then Forums will contact Launchpad and it is Launchpad who processes your authentication), the Forums do not keep your OpenID password (they don't need it at all).

Therefore, all the attackers can get is your OpenID login, but not the password, since it's not actually there.

Also, just for completeness, according to this official announcement, only the Forums are affected, no other services are.

share|improve this answer
1  
It's not only the case that the don't need to save it - they can't even save it as a good OpenID relying party never sees the password of the user. –  moose Jul 25 '13 at 18:42

From http://openid.net/

With OpenID, your password is only given to your identity provider, and that provider then confirms your identity to the websites you visit. Other than your provider, no website ever sees your password, so you don’t need to worry about an unscrupulous or insecure website compromising your identity.

The identity provider is for instance Google and the website you visit is UF.

So yes you should be safe.

share|improve this answer

Generally speaking (to the best of my knowledge, at least) when using an Open ID account to log in, the authentication is handled purely by the external website (so for example, if I were to use Facebook to log in here, the authentication would be handled purely by Facebook and not by Ask Ubuntu). The other site only hands over a unique identifier that tells the Ubuntu Forum / Ask Ubuntu / whatever that you are you, and doesn't pass on any of your login details.

So the passwords stored (+ hashed and salted) by the Ubuntu forum would be for local accounts only (as mentioned in the "What we know" section of the current maintenance page)

Of course if you're still concerned about it, it wouldn't hurt to change your passwords - and for peace of mind it would probably be a good idea to do so anyway - but as far as I am aware unless the service you used to authenticate your Open ID was breached (Google, Facebook, etc) there shouldn't be too much cause to worry.

See this page on the OpenID website for further details.

share|improve this answer

If you really used OpenID: No.

The login process is executed between your OpenID provider and you. The services that allows you to use OpenID doesn't even see your password! There is no possibility how ubuntuforums could have stored your password.

OpenID resources

The following resources might help you to understand how OpenID works.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.