Should I encrypt OpenID in my database?

Question

I store OpenIDs in a database, so I can log in very quickly. Should I encrypt them in my database?

An alternative question would be, are they considered “sensitive” information?

Answer 1

Unlike the other answer: None . There is no point in doing this.

To access your account, you must first authenticate with OP. There is no way to somehow get into someone else's account, just knowing the identifier (and only that).

The OpenID design protocol allows users to place their identifiers in very obvious places (for example, on their home page) with little additional risk. If identifiers were intended for "sensitive" information, it would be impossible to delegate OpenID.

If the fact that your database was compromised would mean that the attacker has access to all identifiers, OpenID will be really, really insecure (and this is not so).

An OpenID is just a URL pointing to a provider. From this information you cannot deduce anything other than that which the user claims (and in the case of directional identity, not even that).

You might ask yourself: "Do I have to encrypt logins?" If your answer is correct - encrypt the identifiers, because they are no different. If this is not the case then do not worry.