PHP OpenID doesn't work with Google/Yahoo and 'hacks' fix it... are they safe? -

I am experimenting with OpenID, and have set up a sample web page to use my OpenID account. I'm using it and it was not working with my Google account. A small research pointed to me, which suggests the problem that Google uses https and ...

... possibly HTTPS Setup has been bored to make a request To verify that you have a CA-certificate package installed on your PHP server.

In the same thread, anyone links to people I have posted and successfully used with my Google account, other optimization for optimizing other questions ( , ...)

I'm not very hot on security, so I ask; Does anyone know that this is the reason not to use hacked versions?

What is the deficiency by this hack design in the original library, and therefore hack is a potential security vulnerability?

Is there a qualified crypto-episode, who saw any of these solutions and "with the beard of David Chowme!" No! "

If so - - and so I can not use any of these hacks - how will I check that I have" CA-certificates package installed "?

Here's the author of one of the "hacked" versions written:

Specifically CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are true by default: I set them to false and it worked for test page!

HTT The most important reason is that HTTPS is useful in OpenID that it is a guard against a man-in-the-middle attack, i.e. some bad boy has your DNS cache google.com request to bad -guys.example . With properly configured HTTPS, you verify the certificate on the connection, find out that it is not from Google Was, and says, "I say nothing to the universe Unless, you do not verify any certificates (You <00> all SSL_VERIFY Set options to false ), in that case your server believes that everything bad boy says that it was a real Google provider. You can imagine how bad it can be.

Now, obviously, this is not the worst option created by you, because it's not worse than just using HTTP, which is being used by many people anyway We do. If you just say that you are not, you are providing HTTPS-level protection.

And there is a lot of information in it that it is not easy or no DNS-based attack, or how easy it is to attack someone on the connection between your server and Google, by any means Is required, which is harder to attack the connection between the usually coffee shop and the user's laptop in your server.

But still, actually it is better to fix your PHP or curl SSL configuration. Or, if you do not do this, warn your users that when they sign up with HTTPS identifiers, they can choose whether they actually want to use that OpenID with your site.

Which goes towards your second question, I think, you do not know anything about the server platform you are using, the best part is that I can link to you ; See section "Get a better / different / new CA certificate bundle!"