Password same-account indicators on websites

Question

I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute).

I am looking at ways of telling users that they can use their X Network username/password details on our specific websites.

However - one interesting point I've thought is that are these essentially a sign of a false sense of security?

For example - Say you are logging into to "Website A" and you see the "X Network" logo, so you know you can log in there.

Now for example, a Phisher sets up "Website P" and puts the "X Network" logo on it so people think it is a part of the X Network.

Are these more hassle than it's worth?

Is it just easier to let the user type their email in, and find out that way they have an account and then tell them where their account is probably from? Or even safer - logging where it was registered and telling them, or emailing them with the information on X failed login attempt(s).

Answer 1

Based on what you've stated, a few of your thoughts raise some security concerns:

1. What protocols are you using to build these 'trusts' between the web sites? You should not be building your own cross-site authentication mechanisms. Is is never a good idea to create these mechanics yourself. From a security perspective it is very dangerous, unless you truly understand the implications and downfalls.
2. The concern you have about phishing is really not specific to the scenario you've described. An attacker can always create a evil-copy-cat website that appears to be the legitimate site.
3. Unless you are using some method of secure access delegation (such as OAuth, or SSO), I would argue against encouraging users to use the same passwords between the different websites. Best practice states not to reuse passwords and that password reuse weakens the overall security of the entire collection of websites.
4. Basic user account enumeration is an issue here. It also sounds like an attacker would be able to enter email addresses into one of the login pages and be able to see what other website the email is associated with. If the attacker understands that the credentials between the associated websites are the same, then this makes it easy for the attacker to login to these websites by only compromising one of user's credentials.

I assume these websites are on a trusted internal company network. If you can provide more details on why you are thinking of building something custom instead of implementing SSO then we may be able to provide a better answer.

Answer 2

If you want a "X Network Site" indication that can't be spoofed you might be able to use an EV certificate. But you'd also need to actually train your users to look for it because nobody really pays any attention to them normally.