The Seven Deadly Sins of Web Apps, or a Bit About SSO Bugs

on YouTube ↗37m

" summary

A talk about common implementation mistakes in Single Sign-On and the OAuth and OpenID Connect protocols, focusing on how subtle issues and multitenancy weaken authentication security. It uses concrete examples and known vulnerabilities (e.g., BingBang, GhostToken) and shows cases from Azure and GCP to illustrate these pitfalls.

AI-written summary · about

" chapters (8)

1. 0:00SSO introduction
2. 1:47Authentication protocols
3. 10:58Identity providers
4. 14:08Vulnerability examples
5. 22:54AD and Entra ID attacks
6. 26:27Social sign-in bugs
7. 30:25Ghost Token and mutable claims
8. 34:18Summary and recommendations

" related talks

• 46mSecure SSO Authentication: Strategies to Eliminate VulnerabilitiesOleh Oliushkevych · .NET fwdays'24
• 01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId ConnectNahid Farrokhi · NDC Sydney 2020
• 40mModern Single Sign-On: On the Security of Single Sign-On ...Louis Jannett · RuhrSec Day 2022
• 01h 02mOpenID Connect & OAuth 2.0 – Security Best PracticesDominick Baier · NDC Oslo 2020
• 18mOne Identity to Rule Them AllSébastien Ferrer · Devfest Strasbourg 2024
• 30mOMG WTF SSO: A Beginner’s Guide to Single Sign-On...Adina Bogert-O'Brien · SREcon24 Europe/Middle East/Africa
• 39mSecuring your apps with OAuth2 and OpenID ConnectRoland Guijt · Codemotion Rome 2015
• 27mSecurity Issues In OAuth/OIDC ImplementationsAmir Sharif · sec4dev 2021