{"id":2924,"date":"2012-04-23T07:00:38","date_gmt":"2012-04-23T15:00:38","guid":{"rendered":"http:\/\/www.formtek.com\/blog\/?p=2924"},"modified":"2012-04-23T07:00:38","modified_gmt":"2012-04-23T15:00:38","slug":"single-sign-ontechnology-security-flaws-prove-worrisome","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/single-sign-ontechnology-security-flaws-prove-worrisome\/","title":{"rendered":"Single Sign On\/Technology: Security Flaws Prove Worrisome"},"content":{"rendered":"

Single sign-on (SSO)<\/a> creates a single authentication mechanism that allows a user to gain access to multiple software systems after logging in once. \u00a0It eliminates the need to separately login to each application that the user interacts with and reduced complexity for the user since only a single password is used across all applications. \u00a0SSO is often used by businesses for users to access applications running within the local internet, but it increasingly is being used by consumer web-based application.<\/p>\n

OpenID <\/a>is a popular web application SSO authentiction mechanism that is used by Google, PayPal, Facebook, JanRain, Freelancer, FarmVille, Sears.com, Universal Music Group, France Telecom, Novell\u00a0and quite a few other consumer web sites. \u00a0In fact, as of 2009 there were over one billion OpenID enabled user accounts and more than 50,000 web sites<\/a> accepting OpenID.<\/p>\n

But how secure is SSO? \u00a0Surprisingly it’s an area that really hasn’t been given that much attention, despite it’s increasing use. \u00a0Because of the complexity of the technology, many developers often implement SSO without a solid understanding of how it works, resulting in implementations with security flaws. \u00a0New research finds the security of SSO to be “worrisome”.<\/p>\n

In a paper<\/a> byIndiana University and Microsoft researchers Rui Wang,\u00a0Shuo Chen<\/a>, and XiaoFeng Wang, 8 serious security flaws were found with OpenID SSO authentication. \u00a0Rui Wang commented that<\/a> “These bugs allow an unauthorized party to log into legitimate users\u2019 accounts \u2026 thereby completely defeating their authentication protection.” \u00a0XiaoFeng Wang said <\/a>that\u00a0“The problem here is that the authentication system makes life easier but it makes security management more challenging.”<\/p>\n

The two biggest reasons for why these flaws exist is:<\/p>\n