Exploring the Security Implications of Single Sign-On Deployments in the Wild

Web services face challenges with online identity and account management, especially in the face of security breaches and misuse. The rise of social media has led to the adoption of Single Sign-On (SSO) systems, allowing users to access multiple services using one identity provider (IdP) account, such as Facebook. While SSO systems offer users the convenience of accessing multiple services using credentials from trusted IdPs, they increase the attack surface and introduce new potential security vulnerabilities. This dissertation explores the security ramifications of SSO in the context of web services. First, we unveil a set of novel SSO-driven attacks that can amplify account compromises, revealing that many services do not have adequate measures for account recovery post-compromise. In response, we introduce “Single Sign-Off”, a method to terminate access to all linked services if an IdP account is compromised. Next, motivated by our findings, we develop an automated framework, SAAT, which evaluates the SSO implementation in relying parties (RPs) at scale, uncovering a notable inconsistency in SSO maintenance and security measures. Our research further highlights the potential risks of combining SSO with conventional authentication methods, including the bypassing of two-factor authentication and CAPTCHAs, emphasizing new vulnerabilities that can jeopardize account security.