%0 Conference Proceedings
%T From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?
%+ Università degli studi di Genova = University of Genoa (UniGe)
%+ Security & Trust Research Unit [Trento]
%+ SAP Research
%+ Siemens AG [Munich]
%+ IBM Research [Zurich]
%A Armando, Alessandro
%A Carbone, Roberto
%A Compagna, Luca
%A Cuellar, Jorge
%A Pellegrino, Giancarlo
%A Sorniotti, Alessandro
%Z Part 3: Authentication
%< avec comité de lecture
%( IFIP Advances in Information and Communication Technology
%B 26th International Information Security Conference (SEC)
%C Lucerne, Switzerland
%Y Jan Camenisch
%Y Simone Fischer-Hübner
%Y Yuko Murayama
%Y Armand Portmann
%Y Carlos Rieder
%I Springer
%3 Future Challenges in Security and Privacy for Academia and Industry
%V AICT-354
%P 68-79
%8 2011-06-07
%D 2011
%R 10.1007/978-3-642-21424-0_6
%Z Computer Science [cs]Conference papers
%X Browser-based Single Sign-On (SSO) is replacing conventional solutions based on multiple, domain-specific credentials by offering an improved user experience: clients log on to their company system once and are then able to access all services offered by the company’s partners. By focusing on the emerging SAML standard, in this paper we show that the prototypical browser-based SSO use case suffers from an authentication flaw that allows a malicious service provider to hijack a client authentication attempt and force the latter to access a resource without its consent or intention. This may have serious consequences, as evidenced by a Cross-Site Scripting attack that we have identified in the SAML-based SSO for Google Apps: the attack allowed a malicious web server to impersonate a user on any Google application. We also describe solutions that can be used to mitigate and even solve the problem.
%G English
%Z TC 11
%2 https://inria.hal.science/hal-01567599/document
%2 https://inria.hal.science/hal-01567599/file/978-3-642-21424-0_6_Chapter.pdf
%L hal-01567599
%U https://inria.hal.science/hal-01567599
%~ IFIP
%~ IFIP-AICT
%~ IFIP-TC
%~ IFIP-TC11
%~ IFIP-SEC
%~ IFIP-AICT-354