Pirates Be Lurkin' at the Single Sign-On Watering Hole

No ratings

Presented at BsidesOklahoma 2017 by

Rodney Beede

Pirates Be Lurkin' at the Single Sign-On Watering Hole Enterprises have standardized on offering web-based applications for their user community and are using Single Sign-On to make accessing them simple and secure. But if an attacker finds a weakness in the Single Sign-On environment, they can access all web applications as though they were legitimate users. This talk discusses a mass-compromise scenario in certain real Single Sign-On environments and more importantly how to avoid it.