Before this gets flagged as a duplicate, I'm not asking a question about the disadvantages of single sign-on, I'm asking if the initial concept is flawed to begin with without enforcing two-factor authentication.
Let me explain what I mean:
1. The purpose of a password is to stop unauthorized people from accessing protected data.
2. We do not use the same password for every account because that potentially exposes all accounts when one is hacked.
Now enters Single Sign-On. Now millions of people put all their eggs (passwords) in one basket. This violates #2 because if the SSO provider gets hacked, then all the accounts are potentially exposed. Just look at the most recent (of several) hack on LastPass in 2015, and the even more recent hack of OneLogin in 2017, even having the ability to decrypt data.
Now with two-factor authentication, specifically using "something you have" as the second factor, you most likely prevent yourself from being the target of an SSO provider hack, unless the tokens were stolen too (but 2FA vulnerabilities are a whole other discussion.)
So how is SSO (without 2FA) much better than just using the same (lengthy) password all over, or maybe better, 3 passwords, so you have 3 chances to get it right (which shouldn't exceed password try limits) and you split any comprised password into 1/3 of all your accounts.
NOTE: I do not endorse using the same password over again. I personally have a unique password for every one of my 100 or so logins with a system that allows me to remember them, but I want to entertain the contrasts for the purpose of conversation.
Is there really a huge difference between using SSO (without 2FA) versus using 1 (or more) password (following the Password Do's and Don'ts) besides just shifting the job of password protection from 100 companies to just 1?
Now you could argue that you decrease your chances of getting hacked by shifting the security responsibility from 100 companies to just 1, but then I would ask if you would do better to have 100 unique passwords stored in 100 different companies than to have 100 passwords in 1 company.
All this just so raise the issue...
- Does single sign-on make sense (from a security point of view) if we are not using Two-Factor Authentication?
- Should we enforce Two-Factor Authentication when using Single Sign-On?
- Without Two-Factor Authentication are we potentially giving people a false sense of security?
Please let me know if there is there something that I'm not taking into account.