2

I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute).

I am looking at ways of telling users that they can use their X Network username/password details on our specific websites.

However - one interesting point I've thought is that are these essentially a sign of a false sense of security?

For example - Say you are logging into to "Website A" and you see the "X Network" logo, so you know you can log in there.

Now for example, a Phisher sets up "Website P" and puts the "X Network" logo on it so people think it is a part of the X Network.

Are these more hassle than it's worth?

Is it just easier to let the user type their email in, and find out that way they have an account and then tell them where their account is probably from? Or even safer - logging where it was registered and telling them, or emailing them with the information on X failed login attempt(s).

  • Huh? "Use your X Network creds here" is a 'security' message? There is no 'false sense of security' because it's merely a convenience message. "Are these more hassle than it's worth?" Are what more hassle? As for your last paragraph, what are you wanting to achieve with any of that? – schroeder Aug 30 '17 at 21:11
  • BTW, you are creating an 'authentication system', not a 'user system'. If you shift your thinking this way, you might see the problem differently. – schroeder Aug 30 '17 at 21:14
1

Based on what you've stated, a few of your thoughts raise some security concerns:

  1. What protocols are you using to build these 'trusts' between the web sites? You should not be building your own cross-site authentication mechanisms. Is is never a good idea to create these mechanics yourself. From a security perspective it is very dangerous, unless you truly understand the implications and downfalls.
  2. The concern you have about phishing is really not specific to the scenario you've described. An attacker can always create a evil-copy-cat website that appears to be the legitimate site.
  3. Unless you are using some method of secure access delegation (such as OAuth, or SSO), I would argue against encouraging users to use the same passwords between the different websites. Best practice states not to reuse passwords and that password reuse weakens the overall security of the entire collection of websites.
  4. Basic user account enumeration is an issue here. It also sounds like an attacker would be able to enter email addresses into one of the login pages and be able to see what other website the email is associated with. If the attacker understands that the credentials between the associated websites are the same, then this makes it easy for the attacker to login to these websites by only compromising one of user's credentials.

I assume these websites are on a trusted internal company network. If you can provide more details on why you are thinking of building something custom instead of implementing SSO then we may be able to provide a better answer.

  • I imagine that the 'network' is not a trust but a shared login mechanism and all sites are under the control of the same organisation. – schroeder Aug 30 '17 at 21:12
  • In that case, I would still discourage having an indicator that the same credentials are being used on other websites within the organization. I just can't think of a single good example where something like what the OP described has been implemented. I wouldn't place too much faith in trying to make this secure based on a custom solution... – SecretSasquatch Aug 30 '17 at 21:20
0

If you want a "X Network Site" indication that can't be spoofed you might be able to use an EV certificate. But you'd also need to actually train your users to look for it because nobody really pays any attention to them normally.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.