On the Security and Privacy of Modern Single Sign-On in the Web (33c3)
- Title:
- On the Security and Privacy of Modern Single Sign-On in the Web (33c3)
- Description:
-
more » « less
https://media.ccc.de/v/33c3-7827-on_the_security_and_privacy_of_modern_single_sign-on_in_the_web
(Not Only) Attacks on OAuth and OpenID Connect
Many web sites allow users to log in with their Facebook or Google account. This so-called Web single sign-on (SSO) often uses the standard protocols OAuth and OpenID Connect. How secure are these protocols? What can go wrong?
OAuth and OpenID Connect do not protect your privacy at all, i.e., your identity provider (e.g., Facebook or Google) can always track, where you log in. Mozilla tried to create an authentication protocol that aimed to prevent tracking: BrowserID (a.k.a. Persona). Did their proposition really solve the privacy issue? What are the lessons learned and can we do better?
['Guido Schmitz (gtrs)', 'dfett']
- Video Language:
- English
- Duration:
- 01:04:05
|
cupkake edited English subtitles for On the Security and Privacy of Modern Single Sign-On in the Web (33c3) | |
|
C3Subtitles edited English subtitles for On the Security and Privacy of Modern Single Sign-On in the Web (33c3) | |
|
|
C3Subtitles edited English subtitles for On the Security and Privacy of Modern Single Sign-On in the Web (33c3) | |
|
|
C3Subtitles edited English subtitles for On the Security and Privacy of Modern Single Sign-On in the Web (33c3) | |
|
|
C3Subtitles added new URL for On the Security and Privacy of Modern Single Sign-On in the Web (33c3) | |
|
|
C3Subtitles added a video: On the Security and Privacy of Modern Single Sign-On in the Web (33c3) |