Hot answers tagged

79 votes
Accepted

Why don't some services offer Google/Facebook/Apple/Twitter login

There are a variety of reasons that a company may not want to offer a federated login option. Some of them include the following: People don't necessarily protect their social media accounts very ...
user avatar
  • 6,950
55 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

In addition to the excellent reasons already mentioned in the other answer: Single sign-on / federated authentication means the identity provider knows what site/service you're signing into, and when....
user avatar
  • 39.1k
44 votes
Accepted

Why do I need Kerberos when I could just use a username and password to access services?

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine ...
user avatar
37 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

Tackling this from an engineering perspective, it’s not necessarily trivial to provide third-party login services. OAuth2 does make it easier, but you can’t technically just slap a login button on ...
user avatar
27 votes

Why do I need Kerberos when I could just use a username and password to access services?

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's ...
user avatar
  • 9,227
22 votes
Accepted

How does SSO enhance security?

The idea with a good single sign on is that there are fewer places for your credentials to be compromised. There are three reasons to use different passwords, first, because each unique place that ...
user avatar
  • 41.8k
15 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

To extent CBHacking's point, the privacy issue is not just for people using this to sign in (which can be considered acceptable since using the federated login can be optional/users can choose which ...
user avatar
12 votes

Why is OpenID considered secure when password reuse is not?

The point of OpenId or other similar mechanisms is that it allows you to select a single, highly trustworthy organisation to hold your credentials. There is an assumption that they are in some way ...
user avatar
  • 2,141
12 votes

Why do I need Kerberos when I could just use a username and password to access services?

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes ...
user avatar
12 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

I can think of a few reasons: SSO means that it is the SSO provider that says who your users are. Technically they could deny legitimate users or impersonate them. Obviously there are legal barriers ...
user avatar
  • 221
11 votes
Accepted

SAML, and forcing a re-authentication

For SAML 2.0 identity providers that support it you can pass ForceAuthn="true" as an attribute for the AuthnRequest. This will tell the IdP to not use any previous security context when authenticating ...
user avatar
  • 1,905
11 votes
Accepted

Self-signed certificate for a IdP-initiated SAML SSO

TL;DR: Self-signed certificates are fine, and even recommended at least in some contexts. Use long validity times to avoid key rollover problems, and if RSA, use at least 2048-bit keys. SAML 2.0 ...
user avatar
  • 7,670
10 votes
Accepted

Why is OpenID considered secure when password reuse is not?

TL;DR: You're not using a passphrase multiple times with OpenID, but have other parties (like Stack Exchange) trust your identity provider (like Google) to be carefully authenticating you. The ...
user avatar
  • 23.2k
10 votes

Why don't some services offer Google/Facebook/Apple/Twitter login

In addition to @CBHacking and @bk2204: The service provider may not want to be bound by the Apple/Google/Facebook conditions for doing business or technical requirements. E.g. crypto and porn are ...
user avatar
  • 3,385
9 votes
Accepted

SAML 2.0 IdP metadata security

The metadata file doesn't have any sensitive information in it. It provides information that the SP can use to trust an assertion coming from [IdP] (so no one else can claim to be [IdP]). The typical ...
user avatar
8 votes

SSO - What should happen when the user clicks "Log out"

This is one of those places usability and security cause radically different answers. From a usability standpoint I have observed the following arguments: When I logout on Site a I only logout form ...
user avatar
  • 8,151
8 votes

Why do I need Kerberos when I could just use a username and password to access services?

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of ...
user avatar
  • 32.6k
8 votes

SAML assertion encryption and using same key for encryption as signing

Encrypting the SAML assertion is optional. Whether or not it's encrypted, you still have privacy through the transport layer security. Scenarios where encrypting the SAML assertion should be ...
user avatar
7 votes

How does SSO enhance security?

The more passwords the user has, the harder they get to manage. They will forget their passwords more frequently, which means they will need to contact a helpdesk or an automated system to reset it. ...
user avatar
  • 48.8k
7 votes

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

It seems to me this OpenID Connect scheme should do it. Note though that I'm not a security expert, so don't use it without further confirmation. User is unlogged to a.com, b.com, sso.com. User goes ...
user avatar
6 votes
Accepted

Designing single-sign-on with JSONP/CORS?

OAuth is flexible, and sometimes the OAuth flow is modified for application specific needs. The most common two flows are 2-legged and 3-legged, which if these flows are implemented correctly, then ...
user avatar
  • 46.8k
5 votes

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

The easiest and only way you can do SSO without any redirect at all is if all of your applications run on subdomains (a.site.com, b.site.com). Subdomains can share domain level cookies, so that your ...
user avatar
  • 31k
5 votes
Accepted

SHA1 signature in a SAML request

I work as a security consultant for SAML 2.0 implementations on a daily basis, mainly for business scenarios. Said that, most security teams are OK using SHA-1 for the same reasons described in this ...
user avatar
4 votes

Does referrer header checking offer any real world security improvement?

It will pick off the low hanging fruit, but in general, it is not hard to spoof a header. I would say that if it has caused issues in the past, it is more than likely not worth the risk to your ...
user avatar
  • 143
4 votes
Accepted

Does referrer header checking offer any real world security improvement?

Short answer: no. Long answer: it depends. Referer is a header sent and controlled by the client. You cannot trust any data coming unchecked from the client. As others pointed out, it can be easily ...
user avatar
  • 50.3k
4 votes

Is there a term for Authorizing before Authenticating? Is it even common?

I have seen systems that filter by a list of allowed IP addresses first, so in order to even attempt to use an authentication method you have to be coming from a specified IP address or range. This ...
user avatar
4 votes
Accepted

Is SSO without SSL possible and/or secure?

A quick use of a search engine points me as the first hit to stackoverflow: Are Oauth2 client apps required to have SSL connection? which cites the OAuth 2.0 specification which can be summarized with:...
user avatar
4 votes
Accepted

Is SSO/OAuth inherently broken?

Aside from the legal aspects alluded to by Neil McGuigan in the comments, it's also difficult to perfectly emulate, say, Google. For one thing, when I log in, Google shows my profile picture. Second, ...
user avatar
4 votes
Accepted

Is it advisable to create a system that stores passwords?

You are right in suspicion that storing all passwords in unencrypted notepad file is a bad idea. Good news is, systems you seek exist and they are called password managers. Password managers store ...
user avatar
  • 162

Only top scored, non community-wiki answers of a minimum length are eligible