OpenID Warns of Serious Remote Bug, Urges Upgrade

Trailrunner7 writes "The OpenID Foundation is warning users about a weakness in the software that could enable an attacker to change some of the data exchanged between parties that use OpenID. The group is telling sites that implement OpenID to update to a new version in order to fix the problem. The bug in OpenID lies in the system's Attribute Exchange, an extension that gives sites the ability to exchange identity information between endpoints. OpenID, an open source project that enables users to prove their identity to myriad sites without providing their passwords, is used by a slew of popular sites, including Google, Yahoo and Flickr."

Re:The concept of OpenID doesn't seem very secure

[brusk]

If you're shaking a sieveful of eggs, the size of the holes isn't your biggest problem.