The Most Secure Implementation of OpenID

Question

What is the most secure implementation of OpenID technology?

Is there someone out there who knows enough about security, cryptography and OpenID specifications? No rumors, just facts.

I would like to know all about insecurities of network communication process between OpenID provider and OpenID-enabled site during:

• logging in
• is user logged?
• user's sensitive information interchange
• logout

and what should we be aware of.

Answer 1

Yeah, SAML is good. It has strong encryption between two endpoints. SAML 2.0 has a good binding protocol for messaging through HTTP or SOAP. It also covers identity assertions, so you can better authenticate that the user is who they say they are.

Answer 2

What is security but an illusion given to the weak by the strong...I trust because I must, I hope because I'm not smart enough to grasp everything, and I ask questions that have no real answer...just momentary agreements between the smart...

I'd say Google probably has the most secure implementation. They have billions of dollars and really smart people.

Answer 3

We use SAML.