18

I honestly can't remember what I used to login to Ubuntu Forums, but I am quite sure it was OpenID. Should I be concerned?

2
  • 4
    OT close voter(s): This question is definitely on-topic; we help people with Ubuntu community resources here ("Services provided by Ubuntu"). Furthermore, it does not belong on meta, which is only for questions about Ask Ubuntu itself (not about other Ubuntu-related sites). It might be considered a duplicate of this earlier question though. If we close either of these as a duplicate of the other I recommend merging their answers. Jul 25, 2013 at 4:40
  • About merging answers: I had seen the other question but did not know if that applied to my case, to be honest. Jul 25, 2013 at 16:03

4 Answers 4

15

Since OpenID login is always processed on the issuer side (for example, if you use OpenID you got from Launchpad, then Forums will contact Launchpad and it is Launchpad who processes your authentication), the Forums do not keep your OpenID password (they don't need it at all).

Therefore, all the attackers can get is your OpenID login, but not the password, since it's not actually there.

Also, just for completeness, according to this official announcement, only the Forums are affected, no other services are.

1
  • 1
    It's not only the case that the don't need to save it - they can't even save it as a good OpenID relying party never sees the password of the user. Jul 25, 2013 at 18:42
8

From http://openid.net/

With OpenID, your password is only given to your identity provider, and that provider then confirms your identity to the websites you visit. Other than your provider, no website ever sees your password, so you don’t need to worry about an unscrupulous or insecure website compromising your identity.

The identity provider is for instance Google and the website you visit is UF.

So yes you should be safe.

3

Generally speaking (to the best of my knowledge, at least) when using an Open ID account to log in, the authentication is handled purely by the external website (so for example, if I were to use Facebook to log in here, the authentication would be handled purely by Facebook and not by Ask Ubuntu). The other site only hands over a unique identifier that tells the Ubuntu Forum / Ask Ubuntu / whatever that you are you, and doesn't pass on any of your login details.

So the passwords stored (+ hashed and salted) by the Ubuntu forum would be for local accounts only (as mentioned in the "What we know" section of the current maintenance page)

Of course if you're still concerned about it, it wouldn't hurt to change your passwords - and for peace of mind it would probably be a good idea to do so anyway - but as far as I am aware unless the service you used to authenticate your Open ID was breached (Google, Facebook, etc) there shouldn't be too much cause to worry.

See this page on the OpenID website for further details.

1

If you really used OpenID: No.

The login process is executed between your OpenID provider and you. The services that allows you to use OpenID doesn't even see your password! There is no possibility how ubuntuforums could have stored your password.

OpenID resources

The following resources might help you to understand how OpenID works.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .