Analysing the Security of Google's implementation of OpenID Connect

Many millions of users routinely use their Google accounts to log in to relying party (RP) websites supporting the Google OpenID Connect service. OpenID Connect, a newly standardised single-sign-on protocol, builds an identity layer on top of the OAuth 2.0 protocol, which has itself been widely adopted to support identity management services. It adds identity management functionality to the OAuth 2.0 system and allows an RP to obtain assurances regarding the authenticity of an end user. A number of authors have analysed the security of the OAuth 2.0 protocol, but whether OpenID Connect is secure in practice remains an open question. We report on a large-scale practical study of Google's implementation of OpenID Connect, involving forensic examination of 103 RP websites which support its use for sign-in. Our study reveals serious vulnerabilities of a number of types, all of which allow an attacker to log in to an RP website as a victim user. Further examination suggests that these vulnerabilities are caused by a combination of Google's design of its OpenID Connect service and RP developers making design decisions which sacrifice security for simplicity of implementation. We also give practical recommendations for both RPs and OPs to help improve the security of real world OpenID Connect systems

Observation of the onset of strong scattering on high frequency acoustic phonons in densified silica glass

The linewidth of longitudinal acoustic waves in densified silica glass is obtained by inelastic x-ray scattering. It increases with a high power alpha of the frequency up to a crossover where the waves experience strong scattering. We find that \alpha is at least 4, and probably larger. Resonance and hybridization of acoustic waves with the boson-peak modes seems to be a more likely explanation for these findings than Rayleigh scattering from disorder.Comment: 4 pages, 4 figures, to appear in Phys. Rev. Letter

Acoustic damping in Li2_2O-2B2_2O3_3 glass observed by inelastic x-ray and optical Brillouin scattering

The dynamic structure factor of lithium-diborate glass has been measured at several values of the momentum transfer $Q$ using high resolution inelastic x-ray scattering. Much attention has been devoted to the low $Q$-range, below the observed Ioffe-Regel crossover \qco{}$\simeq$ 2.1 nm$^{-1}$. We find that below \qco{}, the linewidth of longitudinal acoustic waves increases with a high power of either $Q$, or of the frequency $\Omega$, up to the crossover frequency \OMco{} $\simeq$ 9 meV that nearly coincides with the center of the boson peak. This new finding strongly supports the view that resonance and hybridization of acoustic waves with a distribution of rather local low frequency modes forming the boson peak is responsible for the end of acoustic branches in strong glasses. Further, we present high resolution Brillouin light-scattering data obtained at much lower frequencies on the same sample. These clearly rule out a simple $\Omega^2$-dependence of the acoustic damping over the entire frequency range.Comment: 5 pages, 5 figures, submitted to the proceedings of IDMRCS 2005, Lille, Franc