On the Security and Privacy of Modern Single Sign-On in the Web - TIB AV-Portal

On the Security and Privacy of Modern Single Sign-On in the Web

00:00

8

Related Material

Chaos Computer Club e.V.

Schmitz, Guido (gtrs) Fett, Daniel (dfett)

Formal Metadata

Title

On the Security and Privacy of Modern Single Sign-On in the Web

Subtitle

(Not Only) Attacks on OAuth and OpenID Connect

Title of Series

Number of Parts

147

Author

Schmitz, Guido (gtrs)

Fett, Daniel (dfett)

License

CC Attribution 4.0 International:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.

Identifiers

10.5446/43794 (DOI)

Publisher

Chaos Computer Club e.V.

Release Date

Language

Content Metadata

Subject Area

Computer Science

Genre

Conference/Talk

Abstract

Many web sites allow users to log in with their Facebook or Google account. This so-called Web single sign-on (SSO) often uses the standard protocols OAuth and OpenID Connect. How secure are these protocols? What can go wrong? <p>OAuth and OpenID Connect do not protect your privacy at all, i.e., your identity provider (e.g., Facebook or Google) can always track, where you log in. Mozilla tried to create an authentication protocol that aimed to prevent tracking: BrowserID (a.k.a. Persona). Did their proposition really solve the privacy issue? What are the lessons learned and can we do better?</p>

Keywords

Speech

Text

Image

00:00

Commodore VIC-20Sign (mathematics)World Wide Web ConsortiumInformation securityInformation privacySingle-precision floating-point formatRoundness (object)Single sign-onSet (mathematics)Information securityStandard deviationPrisoner's dilemmaInformation privacyEndliche ModelltheorieMathematical analysisUniverse (mathematics)Connected spaceComputer animationLecture/Conference

01:06

Computer networkVirtual machineTwitterSpacetimeDifferent (Kate Ryan album)LoginFacebookEmailSingle sign-onPhysical systemAddress spaceWeb pageWebsiteWindowPasswordComputer animation

02:15

FacebookSign (mathematics)Linear subspaceEmailPasswordIdentity managementInternet service providerWeb browserLoginAuthenticationMaizeAuthorizationUsabilityInformation privacyOverhead (computing)ImplementationException handlingTwitterSystem programmingSoftware developerSingle-precision floating-point formatCommunications protocolCryptographyToken ringStandard deviationWeb browserLine (geometry)FacebookIdentity managementFreewareInternet service providerAuthenticationSet (mathematics)Data storage deviceWeb serviceSign (mathematics)Revision controlPoint (geometry)Multiplication signSingle-precision floating-point formatCASE <Informatik>TwitterSoftware developerMereologyOpen setUsabilityElectronic mailing listPasswordStandard deviationProduct (business)CodecAuthorizationDatabaseSeries (mathematics)Communications protocolGroup actionHTTP cookieCryptographyMathematicsCondition numberMessage passingPhysical systemToken ringImage registrationGame controllerData recoveryInformation privacySingle sign-onIdentifiabilityUniqueness quantificationLoginWeb pageOverhead (computing)Exception handlingComputer animation

07:56

System programmingSingle-precision floating-point formatSign (mathematics)Communications protocolAuthorizationCryptographyToken ringAuthenticationAerodynamicsImage registrationInformation privacyIdentity managementDifferent (Kate Ryan album)DisintegrationWeb browserImplementationStandard deviationAuthenticationWebsiteCommunications protocolWorld Wide Web ConsortiumDynamical systemPasswordIdentity managementToken ringEmailLoginSingle sign-onConnected spaceInternet service providerInformation privacyPhysical systemBridging (networking)Real numberImplementationFacebookGoogolWeb browserMathematical singularityCodeRepetitionSingle-precision floating-point formatCASE <Informatik>InformationComputer animation

11:30

Standard deviationMechanism designCommunications protocolInformation securityState of matterMathematical analysisFormal grammarTransport Layer SecurityData modelMechanism designParticle systemCASE <Informatik>World Wide Web ConsortiumSingle-precision floating-point formatState of matterCommunications protocolStandard deviationKnotGroup actionInformation securityInfinityMereologyPoint (geometry)Endliche ModelltheorieReplication (computing)Proof theoryExpert systemTransport Layer SecurityComputer animationLecture/Conference

13:01

Data modelTransport Layer SecurityMathematical analysisFormal grammarInformation securityProof theoryPhishingWeb browserDatabaseMereologyWorld Wide Web ConsortiumProof theoryInformation securityWeb browserNumberMechanism designDatabaseStandard deviationEndliche ModelltheoriePasswordMotion captureReplication (computing)Metropolitan area networkInformation privacyArmComputer animation

14:00

Information securityInformation privacyAuthenticationComputer networkControl flowWeb browserData integrityInternet service providerIdentity managementComputer data loggingAuthenticationInformation privacyFormal languageWeb serviceWebsiteGame controllerLevel (video gaming)Category of beingPhysical systemEndliche ModelltheorieForcing (mathematics)World Wide Web ConsortiumWeb browserCASE <Informatik>Identity managementInternet service providerSingle sign-onLoginINTEGRALInformation retrievalSearch engine (computing)Line (geometry)Computer animation

16:24

Information privacyFacebookGoodness of fitInformation privacyLecture/Conference

17:16

Computer configurationCodeAsynchronous Transfer ModeAuthorizationPasswordClient (computing)FacebookLoginAuthenticationToken ringAsynchronous Transfer ModeCodeAuthorizationNetwork topologyMessage passing1 (number)FacebookWeb browserMereologyToken ringLevel (video gaming)Internet service providerInformation retrievalHTTP cookieIdentifiabilityAuthenticationPasswordClient (computing)Computer configurationElectronic mailing listCartesian coordinate systemUsabilityMultiplication signLine (geometry)RandomizationIdentity managementReading (process)Rule of inferenceComputer animation

20:35

HTTP cookieBitFilm editingGroup actionINTEGRALHTTP cookieToken ringPhysical systemDataflowSoftware developerAuthorizationDifferent (Kate Ryan album)Metropolitan area networkWeb browserCodeComputer animationLecture/Conference

22:35

Web browserLoginAuthenticationPasswordCodeRegular graphDataflowPrice indexIdentity managementAuthenticationForm (programming)Internet service providerPasswordUniform resource locatorWeb browserLine (geometry)Process (computing)ImplementationLecture/ConferenceComputer animation

24:38

Standard deviationAuthorizationServer (computing)Client (computing)ImplementationWeb browserFacebookLoginAuthenticationToken ringAsynchronous Transfer ModeMessage passingGroup actionStandard deviationImplementationUniform resource locatorMixed realityIdentity managementAsynchronous Transfer ModeInternet service providerMathematicsComputer configurationFacebookInformationRepetitionExtension (kinesiology)Line (geometry)RankingMetropolitan area networkWebsiteSoftwareSet (mathematics)Web browserIdentifiabilityAuthenticationDifferent (Kate Ryan album)Electronic signatureReal numberRevision controlInformation retrievalClient (computing)Web pageDomain nameToken ringAuthorizationLoginLecture/ConferenceComputer animationDiagram

28:50

Web browserAuthenticationToken ringLoginElectronic signatureCartesian coordinate systemReal numberVarianceString (computer science)InformationLecture/ConferenceComputer animation

29:41

FacebookAuthenticationToken ringFormal grammarMathematical analysisFacebookIdentity managementInformation securityMessage passingStandard deviationDataflowInternet service providerInformationToken ringGroup actionLattice (order)Mathematical analysisFormal grammarLine (geometry)Computer animationProgram flowchart

31:04

Information securityInformation privacyWeb browserPhysical systemSingle-precision floating-point formatPhase transitionError messageHoaxTerm (mathematics)ImplementationInformation securityProof theoryEndliche ModelltheorieInformation privacyPhysical systemApproximationSpecial unitary groupLevel (video gaming)Single-precision floating-point formatEmailWeb browserSingle sign-onAliasingWeb applicationLecture/ConferenceComputer animation

32:17

Web browserPhase transitionAuthenticationPublic key certificateInternet service providerIdentity managementPhase transitionEmailWeb browserWebsiteSign (mathematics)Public-key cryptography2 (number)NeuroinformatikCanonical ensembleProduct (business)Key (cryptography)Lecture/ConferenceComputer animation

33:48

EmailInternet service providerWeb browserLoginImplementationMessage passingServer (computing)Identity managementAddress spaceAuthenticationInterface (computing)Bridging (networking)Attribute grammarInternetworkingStandard deviationPhysical systemWeb browserWindowAuthorizationLoginOctahedronFrame problemInstance (computer science)Mathematical analysisPhysical lawRight angleWebsiteServer (computing)Identity managementAuthenticationMessage passingAddress spaceAttribute grammarInterface (computing)Centralizer and normalizerBridging (networking)Internet service providerComplex (psychology)Communications protocolEmailMultiplication signRAIDWeb serviceProcess (computing)PurchasingComputer animationLecture/Conference

36:20

Web browserAuthenticationIdentity managementBridging (networking)Identity managementBridging (networking)Address spaceHTTP cookieCASE <Informatik>CuboidEmailWeb browserAuthenticationLoginContent (media)Attribute grammarComputer data loggingRight angleWeb serviceGreen's functionWebsiteComputer fontOpen setLecture/ConferenceComputer animation

38:07

Web browserAuthenticationIdentity managementEmailIdentity managementSet (mathematics)Attribute grammarWeb browserEmailComputer data loggingValidity (statistics)Sign (mathematics)Insertion loss2 (number)AuthenticationInformation privacySoftware bugMereologyLoginPoint (geometry)NumberPatch (Unix)Address spaceElectronic signaturePhysical systemMathematicsOpen setWater vaporAutomatic differentiationMetropolitan area networkContent (media)Boss CorporationComputer animationLecture/Conference

42:24

Communications protocolInformationWeb browserLeakInternet service providerIdentity managementUniqueness quantificationInformation privacyData structureMessage passingInformation securityInternet service providerInformationIdentity managementWeb browserInformation privacyCommunications protocolLeakWordPhysical systemFrame problemLine (geometry)WebsiteForm (programming)Mechanism designSource codeInformation securityMessage passingLatent heatSystem callNormal (geometry)Right angleLoginMeeting/InterviewComputer animation

44:42

Computer wormSingle sign-onPhysical systemInformation securityWorld Wide Web ConsortiumInformation privacyFormal languageCategory of beingWeb browserEndliche ModelltheorieInternet service providerSign (mathematics)Event horizonLine (geometry)Proof theoryLecture/Conference

45:43

Identity managementInternet service providerWeb browserPasswordWindowWeb browserInternet service providerAddress spaceEmailIdentity managementPhysical systemCASE <Informatik>Proof theoryComputer animation

46:33

PasswordDressing (medical)Web browserKey (cryptography)Identity managementEmailSymmetric matrixWeb serviceLine (geometry)Address spaceSymmetric-key algorithmWindowInternet service providerDomain nameCodeLoginPasswordComputer animation

47:35

MaizeCodeData integrityInformation privacyStandard deviationAuthenticationSingle-precision floating-point formatFlow separationWeb browserIdentity managementINTEGRALWater vaporInternet service providerLine (geometry)CASE <Informatik>Cellular automatonDemo (music)RepetitionWindowKey (cryptography)Frame problemCodeInformation privacyInformationQuicksortMultiplication signAddress spaceAuthenticationLeakStandard deviationServer (computing)MalwareMechanism designEmailSource codeScripting languageCommunications protocolMessage passingCategory of beingPublic key certificateLoginWorld Wide Web ConsortiumComputer fileLatent heatProof theorySlide ruleOpen setCentralizer and normalizerComputer animation

52:02

Information privacyProof theorySingle sign-onSoftware developerInformationCommunications protocolInformationResultantMultiplication signConnected spaceInformation securityDemo (music)Category of beingTranslation (relic)Boss CorporationGoodness of fitGroup actionProof theoryWebsiteInformation privacyWordSoftware developerWeb browserAuthorizationLibrary (computing)Standard deviationWorld Wide Web ConsortiumSingle sign-onLecture/ConferenceComputer animation

54:16

ImplementationInformationSoftware developerVirtual machineIdentity managementMultiplication signVirtual machineUniverse (mathematics)Cartesian coordinate systemDecimalInternetworkingDiagramSlide ruleInternet service providerAuthorizationFacebookAuthenticationIdentity managementRoundness (object)OrthogonalityLecture/ConferenceMeeting/Interview

56:10

AuthenticationLoginToken ringWeb browserFacebookIdentity managementInternet service providerUniqueness quantificationMechanism designAuthorizationIdentifiabilityAuthenticationCommunications protocolPublic key certificateInternet service providerIdentity managementEmailKey (cryptography)Sign (mathematics)Meeting/InterviewComputer animationLecture/Conference

57:13

Decision theoryNeuroinformatikComputer configurationCommunications protocolPhishingComputer programmingStandard deviationSubsetFormal verificationBitMultiplication signLimit (category theory)Scripting languageQuicksortForm (programming)FreewareLecture/ConferenceMeeting/Interview

59:06

Proof theoryEndliche ModelltheorieStandard deviationComputer configurationMereologyMenu (computing)Disk read-and-write headAreaInclusion mapInsertion lossRepetitionWorld Wide Web ConsortiumModel checkingFormal grammarLecture/Conference

01:00:19

World Wide Web ConsortiumEndliche ModelltheorieAddress spaceInternetworkingData storage deviceRepetitionDomain nameEmailBitIdentifiabilityPhysical systemMeeting/InterviewLecture/Conference

01:01:14

Information privacyFormal verificationGame controllerFrame problemIdentity managementCollaborationismPhysical systemInternet service providerWater vaporLine (geometry)Process (computing)Operator (mathematics)Lecture/ConferenceMeeting/Interview

01:02:25

CodeWebsiteMultiplication signIP addressSide channel attackWater vaporSet (mathematics)Source codeAxiom of choiceFitness functionLecture/ConferenceMeeting/Interview

01:03:32

MedianHypermediaCartesian closed categoryRoundness (object)Scaling (geometry)Lecture/ConferenceJSON

Transcript: English(auto-generated)