Are third party authentification provider included via iframe by default considered (in)secure?

Question

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form via an iframe into the website of A (or B/C) where the user puts in his credentials. (A/B/C are hosted under their own, unrelated domain.) Then the user clicks login and if the credentials for X are correct, he is authentificated for website A (or B/C). Alternatively he can click to open a new window from an URL from website X and enter his credentials there (he has to do this for every login).

In my opinion an attacker could make a website like a gaming forum G faking to use X for authentification and fake the iframe and send the entered credentials from user U to his own server and use the credentials of U to authentificate himself at A/B/C as U. U has no clue that they will be used to authentificate against A and not against G as they are the same and A and G are unrelated.

I told X about this but they just answered that entering the credentials outside their own website (outside includes the iframe) would be against their terms of usage but would have to use the new window version and so they don't consider it a security hole. It didn't matter that I showed them prove that nobody used the new window version in the last months (including their own staff).

Therefore I want to know if there is a guideline whether this is considered (in)secure?

(X is mostly used by websites in the areas of HIPA, financial data, sensitive personal information and X promotes himself as very secure for those but also normal areas)

Edit: I don't want to use the framework but I am a (forced) user like many others of the websites A and B and data about me are stored on C and concerned about my security and the security of my data.

Answer 1

I think you see the problem that the user does not know how and where the login form gets submitted without actually inspecting the source code. And that it would be much better if there would be a separate window so that the user can see the URL, ideally together with a trusty looking green bar for https EV certificates.

And although this does not guarantee that the data are actually submitted to this site (i.e. XSS attacks or similar might affect the target or it might be a different target from start) it is better for the user if the same URL is displayed on all logins to the site because this way it can be easier checked if this is the same site as last time and thus if it is still trustworthy.

Therefore I agree with you that this is a usability problem which might make phishing easier and is thus a security problem too. You might point out in your argumentation against X that sites like Paypal never let their login dialogs be embedded into iframes but instead always want to have their own window with the trusty locking green bar and the familiar URL. And they actually teach users to watch out for these signs to detect phishing sites.

Answer 2

You have a lot in your brief explanation, and I think a little more guidance might help.

An iFrame is nothing more than an HTML tag which allows you to embed "documents" into your web page -- in your instance viewing a web page. There are some criticism on this method, but the concept isn't necessarily insecure.

The first thing that needs to be determined is who is responsible for the embedded iFrame. Is it done in house, third party built, off the self product?

Next, has it the application been tested (not the Authentication Application, but they should be able to give a report of compliance that is has if they are worth anything), but has your website that uses the iFrame, by either a team you hired, a third party hired, or the OOTB company hired tested the applicaiton?

Do you have a choice? I personally like to see a redirect to the Authentication Site and have them redirect back to the application.

Does the Authentication Application give you specifics on how to imbed the iFrame? If the application is designed for integration into other application, there is usually dev docs on the subject.