WebApp Sec mailing list archives
Re: OpenID and the web
From: Lucas Oman <me () lucasoman com>
Date: Thu, 27 Mar 2008 11:46:31 -0400
Razi Shaban wrote:
If you use a different account name and password at every single website, then if one account is compromised then all your other accounts are safe.
This is really not so, since most users sign up with the same email address. All an attacker needs to do is crack the email account and use the "forgot password" feature on most websites. Like it or not, most of us already have a single PoF in the security of our online identities.
Lucas Oman -- Web Software Dev Consultant Nerd 912.655.9594 www.lucasoman.com -------------------------------------------------------------------------Sponsored by: Watchfire Methodologies & Tools for Web Application Security Assessment With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F -------------------------------------------------------------------------
Current thread:
- OpenID and the web Steven Rakick (Mar 25)
- Re: OpenID and the web David Wall (Mar 25)
- Message not available
- Re: OpenID and the web David Wall (Mar 25)
- Message not available
- Re: OpenID and the web David Wall (Mar 25)
- Re: OpenID and the web Adrian Migraso (Mar 25)
- Re: OpenID and the web Eric Marden (Mar 26)
- Re: OpenID and the web Babu.N (Mar 26)
- Re: OpenID and the web Razi Shaban (Mar 27)
- Re: OpenID and the web Jeff Robertson (Mar 27)
- RE: OpenID and the web Calderon, Juan Carlos (GE, Corporate, consultant) (Mar 27)
- Re: OpenID and the web Lucas Oman (Mar 27)
- Re: OpenID and the web Razi Shaban (Mar 27)
- Re: OpenID and the web Babu.N (Mar 26)
- Re: OpenID and the web David Wall (Mar 27)
- Re: OpenID and the web Jeremiah Cornelius (Mar 27)
- RE: OpenID and the web Chris Grove (Mar 28)
- <Possible follow-ups>
- Re: OpenID and the web Pete Jansson (Mar 27)
- Re: OpenID and the web baldr (Mar 27)