We are using an application which offers single sign to their systems which is then embedded as an iframe (i.e. the URL is visible in the source of the page)
The SSO security comes from using MD5 to hash a number of components together and the resulting hash is then used in the URL.
For example, there is a server key and that gets mixed with the user email address and the current date so assuming the server key is ABCDEF, the date is 20161007125600 and the email is [email protected]
When this gets hashed it creates a hash of 973897b9cdc4381ae4202a162d28052d and the URL for the iframe is then something like:
Assuming I can decrypt the hash I end up with:
As all the strings use the exact same layout I can pretty easily split this into the email address, the date and the key. By doing so I can now create a hash of [email protected] and pass the MD5 of that into the URL and login as [email protected]
Is this "secure"? Am I over analyzing this? They are quite a large and established company so I would assume they have tested this extensively but I am so averse to MD5 that it has set my senses tingling and I want to find out if it is something to worry about.