There are a number of open protocol and standards designed to deliver mechanisms for enabling the identity attributes of users to be shared between different web sites. Technologies such as OAuth and OpenID are being adopted by small and large size organizations to share or consume user resources across the web. This session is a technical study of some of these emerging user-centric Identity technologies; and more importantly, their key security implications. We will present scenarios of how insecure implementations of these protocols can be abused maliciously. We examine the characteristics of some of these attack vectors, with real-world examples, and focus on secure application implementation and countermeasures against possible attacks. Outline: The talk starts with a swift introduction to OAuth and OpenID with a series of light and fast rotating slides. Next, we will quickly set the foundation for the upcoming attack vectors and countermeasures. The majority of the presentation will be spent on attacks and remediation tips and techniques. We will cover real-world examples of insecure implementations by presenting code snippets and design flaws. Furthermore, we will discuss tactical and practical solutions in relations to : + Confidentiality and Server Trust issues. + Insecure Storage of Credentials on Web and Mobile Applications. + Flawed Session Management Weaknesses + Other attack vectors to be revealed at a later date.