OMG WTF SSO: A Beginner’s Guide to Single Sign-On...
summary
SSO often feels safer but can hide bigger failures: vendors may leave username/password backdoors, offer SSO as optional, or use a brittle attribute mapping lookup table that lets attackers link identities by changing editable usernames. Real incident: Google-to-Squarespace domain migrations let attackers claim domain-admin accounts by guessing emails and setting passwords. Ask whether the vendor can force SSO, how API clients authenticate, whether shared accounts exist, and whether logs and admin controls let customers detect or revoke unexpected linkages. Test by changing user-editable fields.
AI-written summary · about
chapters (7)
- 0:00SSO introduction
- 3:05What is SSO
- 7:36SSO needs and vendors
- 13:41SSO setup questions
- 25:38SSO misconfiguration failures
- 28:51People-level SSO issues
- 29:36Questions about SSO
related talks
16mIs your SSO on point, or is it more like Single Sign-Oh-no?
46mSecure SSO Authentication: Strategies to Eliminate Vulnerabilities
40mModern Single Sign-On: On the Security of Single Sign-On ...
37mThe Seven Deadly Sins of Web Apps, or a Bit About SSO Bugs
22mO Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On
31mIdentity Theft: Attacks on SSO Systems
51mYou Shall Not Password: Modern Authentication for Web Apps
55mYou Shall Not Password: Modern Authentication for Web Apps