Want to play around with a site already using Google’s Friend Connect? Head over to BibleApps running on Joyent Accelerators. The “Sign In” infrastructure is part of the gadgets available from Google Friend Connect. God bless them.
-
« Home
Pages
-
Categories
- Announcements
- Benchmarks
- Benr & Shanr
- Blog Policy
- Blurbs
- Cloud Computing
- Code Snippets
- Coding
- Community
- Connector
- Contest
- Elsewhere
- Events
- General
- Industry
- Infrastructure
- Interviews
- Joyent Labs
- Joyeurs
- Link List
- Long Format
- Media Coverage
- Meetup
- Open Source
- OpenSolaris
- Partnerships
- Podcast
- Press Release
- Quad-Core
- Recipes
- Reviews
- Short Format
- Slingshot
- Special Offers
- Travel
- UI
- Uncategorized
-
Archives
- September 2010
- August 2010
- July 2010
- June 2010
- March 2010
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
- July 2006
- June 2006
- May 2006
- April 2006
- March 2006
- February 2006
One Comment
Is this opening up a can of security worms?
I’ll explain.
So I went out to the BibleApps site and clicked “Sign in”.
It presented me with signing in with Google/Yahoo/AIM/etc.
(Immediately, I think – oh no. This is going to open up a can of worms by unethical sites faking login pages.)
The reason being, for years – we have instructed people for security reason to NEVER give out their login information for site X when on site Y.
Now OpenID and Friend Connect changes all of that. Now, it’s “okay” to give out your Google/Yahoo login information when not on a Google/Yahoo site.
What concerns me is, how do we explain to people now that this is alright? And how do we prevent unethical people from capturing someones Google/Yahoo login information on a fake-login page and then pass that information onto Google/Yahoo?
Does that make sense?
I really like the functionality of Friend Connect and OpenID, and I’m sure it’s implemented in a secure way … what concerns me is that it now seems like it will be extremely easy for sites to “fake” a Google/Yahoo login page because we are now training people that it’s alright to give out your login credentials for a third party site (like BibleApps)