More secure using Google instead of drupal login? [#1191410]

Hello mr programmer!

I click on the google image to login to my drupal site and it works like a charm, thanks! Does this mean that my drupal installation is more secure now since authencitation is done via Google?

Your module works that good I'm actually thinking about getting rid of all other login options for a cleaner interface. When I visit mysite.com/user I would like it to automatically redirect to the Google login page (just as if I click on the Google image myself), can this be done?

Best regards,
Eriksson

Comments

Comment #1

eriksson-1 CreditAttribution: eriksson-1 commented 20 June 2011 at 07:07

I thought authenticating via Google using openid selector meant that no login info. needed to be present in the drupal user database. I just checked the user table in my drupal database and there is a password set for my user account although I login via google and have never set a password in drupal itself.

I suppose this auto-generated-by-openid-selector password needs to be there but my question is; how is the password constructed, is it secure and can it be used without logging in via openid options?

If I've only logged in via Google (and never using a traditional drupal username and password), can I still login via drupal using the password set by openid selector?

Best regards,
Eriksson

Comment #2

thinkling CreditAttribution: thinkling commented 25 July 2011 at 16:33

From a quick look around the code, it looks like the openid module calls the function user_password() in core's user.module to generate a 10-character random password.

Since the password is stored in the DB in hashed form, i.e. garbled with one-way encryption, there is no way to know what the random password was and to log in using it.

Comment #3

xurizaemon

he/him

Ōtepoti, Aotearoa 🏝

CreditAttribution: xurizaemon commented 27 February 2012 at 08:12

Status:

Active

» Fixed

The module is generating user accounts automatically via OpenID, including passwords.

The user a/cs are full local accounts but the user doesn't see the password, and they can just log in via Google (etc) next time too. However a user could request a password reset and log in via normal Drupal process if they wanted to ...

So, no your site is not "more secure" by virtue of this, no.

You might be able to get away with automatically redirecting the user login form to Google, if that's really what you want.