Comments on: OpenSocial insecurity – no user to app authentication http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/ Fast Forward Sun, 18 Jul 2010 17:47:51 +0000 hourly 1 http://wordpress.org/?v=3.0 By: Some OpenSocial thoughts | From the Land of Meh... http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9574 Some OpenSocial thoughts | From the Land of Meh... Mon, 22 Jun 2009 22:51:25 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9574 [...] User data security is an issue: http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/ [...] [...] User data security is an issue: http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/ [...]

]]> By: Some OpenSocial thoughts | You see a 20'x20' room, nothing else interesting... http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9351 Some OpenSocial thoughts | You see a 20'x20' room, nothing else interesting... Mon, 26 Nov 2007 05:37:30 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9351 [...] User data security is an issue: http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/ [...] [...] User data security is an issue: http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/ [...]

]]> By: Open Social: la garantia soy yo! http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9319 Open Social: la garantia soy yo! Wed, 07 Nov 2007 20:07:06 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9319 [...] de que site vem as requests Ajax e qual o ID do usuário. Como gente com experiência no assunto explica, isso não chega nem perto de ser robusto o bastante para mais do que joguinhos e [...] [...] de que site vem as requests Ajax e qual o ID do usuário. Como gente com experiência no assunto explica, isso não chega nem perto de ser robusto o bastante para mais do que joguinhos e [...]

]]> By: miron http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9317 miron Tue, 06 Nov 2007 23:18:56 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9317 Google admits to the hole and gives no timeline, <a href="http://groups.google.com/group/opensocial-api/browse_thread/thread/776cd89a27fe0518/829dc76edcebb830?hl=en#829dc76edcebb830" rel="nofollow">here</a> and <a href="http://groups.google.com/group/opensocial-api/web/opensocial-issues-list?hl=en" rel="nofollow">here</a> (third item down). Google admits to the hole and gives no timeline, here and here (third item down).

]]> By: Tony Stubblebine http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9316 Tony Stubblebine Tue, 06 Nov 2007 22:47:39 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9316 I'd be curious to know how the widget hacks that keep getting reported on TechCrunch are getting closed. It seems like the original Google partners should be sharing their newly learned security best practices. Hopefully, I'd feel better about the security holes if someone on the Google side acknowledged that they rushed everything in order to get there press releases out and that they were in fact committed to working through these issues publicly. I’d be curious to know how the widget hacks that keep getting reported on TechCrunch are getting closed. It seems like the original Google partners should be sharing their newly learned security best practices.

Hopefully, I’d feel better about the security holes if someone on the Google side acknowledged that they rushed everything in order to get there press releases out and that they were in fact committed to working through these issues publicly.

]]> By: miron http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9315 miron Tue, 06 Nov 2007 18:50:13 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9315 Ramon, You'll have to provide more details, your comment is not clear to me. What do you mean by "you can verify the ID ..."? There is no functionality in the API to verify IDs. The second item needs clarification. What kind of application doesn't care about ID spoofing? The third item doesn't make sense, because Ajax is just another way to connect to the back end. It does not provide any additional authentication means. Thanks. Ramon,

You’ll have to provide more details, your comment is not clear to me.

What do you mean by “you can verify the ID …”? There is no functionality in the API to verify IDs.

The second item needs clarification. What kind of application doesn’t care about ID spoofing?

The third item doesn’t make sense, because Ajax is just another way to connect to the back end. It does not provide any additional authentication means.

Thanks.

]]> By: Ramon http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9314 Ramon Tue, 06 Nov 2007 14:17:58 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9314 Hi Miron and Mat, Well you can verify if the ID provided is the actual owner of the ID, that's the first security 'breach' solution. Second: Don't make your application authentication focused, make it owner to friends focused. Third: Implement Ajax calls to verify and/or block any feature you think can be hacked (hijacking, etc.). Sorry, but I cannot give a url right now due to still on going development but once I get into a beta version I will send you the link. Best, Ramon Hi Miron and Mat,

Well you can verify if the ID provided is the actual owner of the ID, that’s the first security ‘breach’ solution.
Second: Don’t make your application authentication focused, make it owner to friends focused.
Third: Implement Ajax calls to verify and/or block any feature you think can be hacked (hijacking, etc.).

Sorry, but I cannot give a url right now due to still on going development but once I get into a beta version I will send you the link.
Best,
Ramon

]]> By: ippimail.com » Blog Archive » OpenSocial: After the hype, the holes http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9311 ippimail.com » Blog Archive » OpenSocial: After the hype, the holes Tue, 06 Nov 2007 02:05:03 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9311 [...] based on the standard hacked within minutes, it quickly became evident that OpenSocial is vulnerable and offers an open door to anyone who wants to put a little effort into pushing it [...] [...] based on the standard hacked within minutes, it quickly became evident that OpenSocial is vulnerable and offers an open door to anyone who wants to put a little effort into pushing it [...]

]]> By: Aehso’s Output » OpenSocial Doc Review Part 2 : Authentication, Hosting and Applications http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9310 Aehso’s Output » OpenSocial Doc Review Part 2 : Authentication, Hosting and Applications Mon, 05 Nov 2007 19:48:06 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9310 [...] Miron highlights another potentially critical problem - track it [...] [...] Miron highlights another potentially critical problem – track it [...]

]]> By: Mat http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/comment-page-1/#comment-9309 Mat Mon, 05 Nov 2007 17:54:53 +0000 http://hyper.to/blog/link/opensocial-insecurity-no-user-to-app-authentication/#comment-9309 Have to say, I agree with miron. I currently cant see how you can prevent again spoofing attacks with a javascript only API, Due to the nature of the app we are creating we need to store a substantial amount of data off on our own servers, and we cant store this in any secure maner (e.g. associating it to a certain user), as we cant trust any info coming from the browser. At the moment I cant see a solution to this, but feel free to enlighten me. Ramon if you could give me the url of your app, maybe a demo could be in order. Mat Have to say, I agree with miron. I currently cant see how you can prevent again spoofing attacks with a javascript only API, Due to the nature of the app we are creating we need to store a substantial amount of data off on our own servers, and we cant store this in any secure maner (e.g. associating it to a certain user), as we cant trust any info coming from the browser. At the moment I cant see a solution to this, but feel free to enlighten me.

Ramon if you could give me the url of your app, maybe a demo could be in order.

Mat

]]>