I started to work on a company whose software engineers tried to reinvent everything. They did not use(or know) industry standarts and for authentication, they use their custom solution. Their "solution" seems to me as very unsecure but I can not prove them.
Their single sign-on solution is like that. They have a web application(portal), everyone authenticate portal with username and password. When they want to access company's other web applications, they have to click Urls on portal that point to other web sites. Portal appends a query string to Urls.
Query string includes a secret data generated from passwords that lie on shared database . When other web apps' login page accept those query strings, it decrypt the secret data and compare it with passwords on database. If those values are equal than forwarded web application authenticate user. They uses their own authorization rules per application. They say that produced links are only usable once and it expires in 24 hour.
I think there are security vulnerabilities.
- They use reversable password that can be decrypted easily.
- Their produced query string can be seen on web history easily and can be used if first time user can not connect.
- I suspect they do not salt secret value, probably secret data can be used again.
Are there any other apparent security vulnerabilities that I do not know yet. I have to persuade them with exact threats