1

I am not questioning the security of the technical implementations of SSO, but the training of users to follow a potentially insecure access pattern.

Background

If you for example roll out SSO (single-sign-on) provider Okta in your organisation, when a user visits a service's website, the service redirects them to Okta for authentication, and after successful login Okta redirects the user back to the service again.

  1. User opens example.com
  2. example.com redirects user to okta.com for authentication
  3. User enters username, password and OTP (one-time password)
  4. okta.com redirects user to example.com

My concern here is that the user expects every password protected website they access within the organisation to redirect to a different URL and ask for the credentials for a different service (in this case Okta).

This is confusing. Confused users can be misled.

Attack

What if the landing page is fake?

  1. User clicks a link they think is for example.com, but actually lands on example.cc-server.com. example.cc-server.com is owned by a malicious actor, but looks exactly like example.com. Or perhaps the user has been told, and believes, that example.cc-server.com is a legitimate provider they have been registered to by the company, and they need to log in to activate it.
  2. cc-server.com redirects user to okta.cc-server.com, which looks exactly like okta.com.
  3. User enters username, password and OTP.

The hacker captures the credentials and uses them to log in to the user's Okta account. From there they can access the Okta dashboard and jump further to all services linked to the SSO provider.

Am I missing something here, or is this access pattern a recipe for phishing attacks?

Would it not make more sense to require the user to always access okta.com first, and then access the sites from there? That way the user is actively connecting to a site with the intention of logging in instead of responding to a prompt to enter credentials. The access pattern is always the same, there are no redirects, and users will be more likely to recognise an altered URL.

1 Answer 1

1

Using single sign-on doesn't necessarily make phishing any easier. It is still possible to pull off a phishing attack like this, but there are some things that make it a bit harder:

  • It's possible to customize the Okta login page, which is also likely true for similar providers, so for many organizations, a phishing attempt must be customized to a particular company.
  • In some organizations, SSO doesn't happen multiple times per day. For example, if Alice did SSO on a Monday morning and then were prompted for it again in the afternoon, that might be suspicious.

Of course, the easiest way to solve this problem is to require FIDO2 or WebAuthn authentication for your SSO provider. Because the signature made by the security key or other device contains the domain of the website, which is provided by the user's web browser, this type of authentication is effectively immune to phishing. Organizations that are concerned about phishing attacks (which, frankly, most should be) should use FIDO2 or WebAuthn security keys. The cost of a $50 YubiKey (or $100 for two) for every employee is peanuts compared to payroll and substantially less than the consequences of a compromise.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .