O Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On
summary
Finds that a cookie hijack of Facebook lets an attacker fully takeover accounts on many sites, demonstrated by capturing 5,700 session cookies from four months of university Wi‑Fi and by crawling Alexa top 1M to measure SSO. Empirical tests against 95 major services show attackers can create persistent alternate auth paths, password changes fail to evict them for ~75% of sites and ~89% offer no session management. Proposes Single Sign-Off extension to OpenID Connect as a practical universal revocation mechanism.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:03Single Sing-On Authentication Flow
- 2:17Single Sign-On, the Good, the Bad and the Ugly
- 5:55Quantifying SSO Adoption
- 8:14Attack Scenarios
- 10:39Long-term Access (variation 2)
- 13:34Preemptive Relying Party Account Takeover
- 14:43Post-Compromise Remediation
- 17:01Single Sign-Off
- 18:16Takeaways
- 18:57Questions
related talks
40mModern Single Sign-On: On the Security of Single Sign-On ...
16mIs your SSO on point, or is it more like Single Sign-Oh-no?
30mFederated Login CSRF
30mOMG WTF SSO: A Beginner’s Guide to Single Sign-On...
43mIf you Give a Hacker a Cookie
16mInnovation in Authentication and More
50mSecure Authentication and Session Management
18mOne Identity to Rule Them All