Skip to main content
79 votes
Accepted

Why don't some services offer Google/Facebook/Apple/Twitter login

There are a variety of reasons that a company may not want to offer a federated login option. Some of them include the following: People don't necessarily protect their social media accounts very ...
bk2204's user avatar
  • 9,514
55 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

In addition to the excellent reasons already mentioned in the other answer: Single sign-on / federated authentication means the identity provider knows what site/service you're signing into, and when....
CBHacking's user avatar
  • 49.3k
45 votes
Accepted

Why do I need Kerberos when I could just use a username and password to access services?

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine ...
Luis Casillas's user avatar
37 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

Tackling this from an engineering perspective, it’s not necessarily trivial to provide third-party login services. OAuth2 does make it easier, but you can’t technically just slap a login button on ...
Austin Hemmelgarn's user avatar
27 votes

Why do I need Kerberos when I could just use a username and password to access services?

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's ...
DKNUCKLES's user avatar
  • 9,217
15 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

To extent CBHacking's point, the privacy issue is not just for people using this to sign in (which can be considered acceptable since using the federated login can be optional/users can choose which ...
Marcel Krüger's user avatar
12 votes

Why do I need Kerberos when I could just use a username and password to access services?

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes ...
duffbeer703's user avatar
12 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

I can think of a few reasons: SSO means that it is the SSO provider that says who your users are. Technically they could deny legitimate users or impersonate them. Obviously there are legal barriers ...
Rad80's user avatar
  • 221
11 votes
Accepted

Self-signed certificate for a IdP-initiated SAML SSO

TL;DR: Self-signed certificates are fine, and even recommended at least in some contexts. Use long validity times to avoid key rollover problems, and if RSA, use at least 2048-bit keys. SAML 2.0 ...
user's user avatar
  • 7,805
11 votes
Accepted

SAML assertion encryption and using same key for encryption as signing

Encrypting the SAML assertion is optional. Whether or not it's encrypted, you still have privacy through the transport layer security. Scenarios where encrypting the SAML assertion should be ...
ComponentSpace's user avatar
10 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

In addition to @CBHacking and @bk2204: The service provider may not want to be bound by the Apple/Google/Facebook conditions for doing business or technical requirements. E.g. crypto and porn are ...
fraxinus's user avatar
  • 3,568
8 votes

Why do I need Kerberos when I could just use a username and password to access services?

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of ...
paj28's user avatar
  • 33.6k
8 votes

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

It seems to me this OpenID Connect scheme should do it. Note though that I'm not a security expert, so don't use it without further confirmation. User is unlogged to a.com, b.com, sso.com. User goes ...
Jan Żankowski's user avatar
6 votes

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

The easiest and only way you can do SSO without any redirect at all is if all of your applications run on subdomains (a.site.com, b.site.com). Subdomains can share domain level cookies, so that your ...
Lie Ryan's user avatar
  • 31.5k
5 votes
Accepted

SHA1 signature in a SAML request

I work as a security consultant for SAML 2.0 implementations on a daily basis, mainly for business scenarios. Said that, most security teams are OK using SHA-1 for the same reasons described in this ...
Filipe dos Santos's user avatar
4 votes
Accepted

Is SSO/OAuth inherently broken?

Aside from the legal aspects alluded to by Neil McGuigan in the comments, it's also difficult to perfectly emulate, say, Google. For one thing, when I log in, Google shows my profile picture. Second, ...
Mike Caron's user avatar
4 votes
Accepted

Is SSO without SSL possible and/or secure?

A quick use of a search engine points me as the first hit to stackoverflow: Are Oauth2 client apps required to have SSL connection? which cites the OAuth 2.0 specification which can be summarized with:...
Steffen Ullrich's user avatar
4 votes
Accepted

Is it advisable to create a system that stores passwords?

You are right in suspicion that storing all passwords in unencrypted notepad file is a bad idea. Good news is, systems you seek exist and they are called password managers. Password managers store ...
Luntri's user avatar
  • 162
4 votes
Accepted

Using SSO for a cryptocurrency app

You are basically asking if Google or Facebook will ever turn evil and command their IT team to steal your customer's account (i.e. initiate an SSO flow) to steal their money. That's something, ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
3 votes

Can password based SSO be trivially compromised?

Technically the Password-based Single Sign-On from Azure AD (from your link) is not an SSO solution but a password management one. The external application has its own credentials including password, ...
Serge Ballesta's user avatar
3 votes

2FA using Kerberos and SSO within CDE

(2FA = Two Factor Authentication, for those just tuning in) I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Kerberos is an authentication ...
gowenfawr's user avatar
  • 72.9k
3 votes

SSO - What should happen when the user clicks "Log out"

There's probably no right answer here, but I'll advocate that "Log Out" only applies to your site. Stack Exchange as an example I use the "Sign in with Google" option. When I click Log Out, I see ...
Mike Ounsworth's user avatar
3 votes

why use a CA-signed key pair to encrypt SAML2 assertions?

I agree that self-signed certificates are sufficient, but the CA approach does add some incremental security in how that trust relationship is maintained, especially when you consider the rollover ...
Steve P's user avatar
  • 442
3 votes

How does encryption, certificates in an end to end SSO flow?

The IdP will sign either the SAML response of the SAML assertion using its private key. The SP verifies the signature using the IdP's public key. It's also possible to encrypt the SAML assertion in ...
ComponentSpace's user avatar
2 votes

How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO)

I had the issue where we would get an authentication popup when trying to authenticate to ADFS from the internet - on our company network it logged in seamlessly. I resolved it by adding our ADFS ...
Leimie's user avatar
  • 21
2 votes

Is it secure to return a JWT to an already-logged-in user?

Really the question should be How can I be certain a signed in user is the same person who signed in so I can send them a JWT? And the answer to that is you can't. This is because of the security ...
Robert Mennell's user avatar
2 votes

SSO - What should happen when the user clicks "Log out"

Questions like this arise when there's confusion about the purpose of "Log out" button. What is "Log out" for? Some preconditions: Usability-wise, if the user does not want to log out, they should ...
antak's user avatar
  • 131
2 votes

Azure AD B2C vs Auth0

Azure B2C is completely a PaaS service, no way/need to host this onpremise. Both handle the users and the login screens. Regarding B2C vs ADFS: B2C is for all external customers. ADFS is a wrapper ...
Erik Oppedijk's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible