Breaking SSO
An analysis of Single Sign-On implementations and deployments focusing on OpenID, uncovering an account-hijacking pattern on newspaper websites and a JSON-format-oracle attack against an identity provider library.
An analysis of Single Sign-On implementations and deployments focusing on OpenID, uncovering an account-hijacking pattern on newspaper websites and a JSON-format-oracle attack against an identity provider library.