SSO Trends and Security Concerns

The constantly changing landscape of contemporary technology, presents many challenges. Of these challenges, maintaining the security and confidentiality many have come to expect has been the most important. The convenience and simplicity of single sign-on may offer many conveniences but it also presents many challenges. The former trend of users needing to have multiple usernames and passwords is obsolete with the implementation of technology from Microsoft .NET Passport and similarly the Liberty system for corporations. The security risks significantly vary with each trend. Although, the latest trend in single sign-on for the Internet may boast ease of use, it presents several significant security concerns for the protection of personal data.

Internet users commonly browse multiple sites that may request personal information including but not limited to name, email address, username and password. Remembering and entering various credentials for every website visited can be very inconvenient for the user. A single sign-on system allowing a user to browse various websites using only one login is a convenient option compared to the alternatives that requires remembering multiple usernames and passwords. Single sign-on technology utilizes a single login at one particular site, to grant access to other sites. The single sign-on software collects all the users sign in credentials, which authenticates the users information at each respective website. The user is required only to sign-in at one website, while the other affiliated websites the user may browse will automatically authenticate using personal information from the original login. This technology has been implemented in both the personal sector and in business, specifically, for use in commerce.

Microsoft Windows 8 currently allows users with a Windows Live ID to automatically log into a Windows 8 laptop, desktop, tablet, or any other embedded device connected to the Internet and running Windows 8. When a user logs into the Windows 8 device with their own Windows Live ID, the operating system will access the Cloud Sky Drive data and import/migrate all personal settings and preferences to the local device. Additionally, this link will validate and access all other accounts associated with the Windows Live ID, including Facebook, YouTube, Flickr and Twitter. Therefore, if a user is logged on to Twitter on their laptop and then switched to their tablet, they would also be logged on to Twitter.

Windows 8 and Windows Live ID will save the status of a currently running application. Therefore, when the user searches for a movie on Fandango, this application will store the session in the Microsoft Cloud. When the user logs into another Windows 8 device connected to the Internet, the device will have the Fandango Application appear within the same session opened on the other device. This feature also works with music, movies and most games. Also, integrated into the Microsoft single sign-on is the ability to be logged into a website even if the computer does not have a cookie for the browser, the SDK will immediately detect that condition and log the user into a website such as ESPN insider or blogger.

The account login service that authenticates the credentials from Windows 8 and Microsoft Windows Live ID contains flaws, which might allow malicious users to acquire unauthorized access to confidential information. Single sign-on services that are supported by ID providers including Microsoft are historically not properly integrated into non-Microsoft websites that use the service. This results in the vulnerability of personal data on the integrated websites such as those operated by Farmville, Freelancer, Target, and ESPN. These integrated websites are vulnerable to snoops, hackers and identity theft. "These flaws are also found to be diverse, distributed across the code of [third-party Websites] and [SSO providers], and at the stages of login and account linking" (Wang, 2012). Even though, Microsoft may have integrated a strong authentication process into its single sign-on system, the many third party websites may not have the stringent security measures needed to protect personal data and preserve the level of authentication offered to the user by Microsoft.

Another problematic instance of single sign-on is often referenced as, “key to the kingdom” (Clercq, 2002) configuration and type of credentials. This metaphor means that once you have access to the single sign-on password, the hacker would have access to all that the user used the single sign-on for. In the .NET Passport single sign-on, the credential required a password combined with the users email address. According to Jan De Clercq, “using bio-metric (such as a fingerprint) or possession-based (such as a smart card) will reduce the risk. However, in real life, there may only be a few people who want to use a smart card or scan their hands to read their Hotmail” (Clercq, 2002). While using this system, Microsoft’s Passport requires an algorithm that checks for weak passwords while the user registers. These features are available on .NET Passport but the password check is incredibly anemic. The .NET Passport only checks the length (more than 6 characters) and if the password contains anything from the email address. User passwords that are repetitive numbers are not checked for.

Another problem with single sign-on is called “Bogus Merchant” (Kormann & Rubin, 2000). When users login to .NET their credentials are passed through passport’s authentication. Currently Microsoft does not offer users the ability to confirm that their credentials were successfully transferred to passport’s authentication process. If the deleterious person forged a Microsoft Passport login webpage, when the user enters their credentials, the users information is acquired by the malicious website. Currently, Microsoft .NET Passport does not remind users to verify correct URL’s before login, though, due to the contemporary genre of malicious sites and phishing pages, this may be an effective measure.

Many organizations are implementing single sign-on solutions to offer more convenience and security. Presently, there are two major single sign-on technologies offered for business to use, centralized and distributed data storage. While there are benefits and security risks associated with using both technologies, each instance of single sign-on is now becoming a major trend in the business world.

A centralized database utilizes a central server which offsite users may access remotely though authentication software. There are numerous advantages to storing information in a centralized location, for example the user only has to depend on one vendor. Microsoft’s .NET passport is a centralized data storage technology. In 1999 Microsoft implemented .NET passport for single sign-on, “it is a single sign on technology that is hosted, owned and managed by Microsoft” (Costa, 2012). Microsoft’s .NET system only utilizes a centralized server that maintains records of all the users information. When the user first starts using Passport, they input all the sensitive data for Passport to manage. When the IT manager logs in to Passport and goes to purchase multiple computers from an internet vendor, the vendor receives a request from .NET and not from the IT manager directly. This system only allows the merchant to receive an ID to the IT manager and the vendor will not be able to log sensitive information. The vendor’s interface looks as if the Passport is making the purchase and not the IT Manager from your company. Passport design is very propitious because it does not relinquish any personal information.

In the decentralized data storage single sign-on system, only the absolutely obligatory is kept at that location or on the users device. In the decentralized single sign-on, the website only stores the users data which is required for that service that it provides. A webpage like fandango would only keep the user’s current location and would keep invisible the users private information. For instance Liberty is a decentralized structure for single sign-on. One of the current trends, Liberty has a decentralized system therefore all the data is not kept on a single device. The Liberty system has an architecture which allows users to link networks. The single sign-on service implemented by Liberty is a “permissions-based attribute sharing to enable organizations to provide users with the choice and control over the use and disclosure of their personal information” (Varney, 2003). Liberty was designed was to have a “commonly accepted platform for building and managing identity-based web service based on open industry standards” (Varney, 2003). When the office secretary books a hotel for the CEO, they login to site X. Website X is a services provider and then authenticates the secretary by communicating with the ID Provider. When the secretary is authorized, the secretary can confirm the reservation and payment details. Then if the secretary needs to rent a car for the CEO, they can go to website Y, as long as it is a website that is enabled by Liberty; the site will contact the ID provider which will authenticate the secretary. This login only happens once because of the single sign-on technology. Website X and website Y interact with one another with different handles so there is no collusion. The two sites share information about the users location or destination, date and time of travel. Liberty’s model of sharing data is convenient and secure because the two websites only receive the required information to accommodate their service. Website Y would not know any personal data from the original website unless the user gives authorization. This ensures only the essential information is obtained by each site. This process improves productivity because the user will be required to enter login information only once.

The previous examples of two different single sign-on systems have distinct differences but both overlap with similar security concerns. Due to the nature in the difference of users, business versus personal, many other security issues arise outside of the overlapping ones. Most user control rights are sacrificed for convenience of service, which could potentially lead to the misuse of data in malicious manner. A main concern of Microsoft .NET Passports is mishandling of the users personal data. Though Microsoft has a privacy policy, they do not have a department monitoring the use of critical data. On the other hand, a concern with Liberty is the server’s validation of credentials. When the server’s credential expires, the server must communicate this to the user registry to authenticate. IBM states, “ extending the time that the LTPA token remains cached presents a slightly increased security risk to be considered when defining your security policies” (IBM, 2010). With Liberty, the person that sets up the software is responsible for how secure the system is; however much customization is present which may allow for many errors in the implementation process.

Every sign-on system has flaws and there are some concerns with single sign-on in general. The use of unchecked and recycled passwords are parallel with single sign-on systems which has the ability to jeopardize multiple accounts with penetrating a single user’s password. The user could choose to use different unassociated logins for every website, this would eliminate the vulnerability of a single login. If the user chooses single login, the risk is the same for each website. The vulnerability can be alleviated if the user implements strength checking for passwords. Using a finger swipe to login into your entire system may also mitigate this risk.

When a user uses Microsoft .NET Passport for personal use or if a company has their employees use the Liberty single sign-on, there are significant risks to both. The user in both systems only has to remember one password, which gives the villainous threat, one password to hack. If a hacker did compromise the system, they could potentially have access to all of the users personal data and if the Liberty single sign-on is compromised, the threat could have access to all users’ information. A benefit of single sign-on is that the user only has one password, but if that password is weak or repetitive, it makes the entire single sign-on system vulnerable. Even though the single sign-on may reduce the amount of password resets MIS departments receive but also presents more difficult concerns when verifying a single sign-on system is secure. In the Liberty system, if the MIS department does not correctly setup the single sign-on system, the entire system could be quickly compromised. The user also has to put faith in the websites that are allow the use Microsoft .NET passports single sign-on that their system is secured and will not be compromised. While not every system has a blue print to be hacked, because of the web traffic that single sign-on achieves, it is often easy to identify weaknesses in the systems. Though there may be benefits to single sign-on for personal use or implementing it for your company, there are varying security risks that must be considered.

Reference

Clercq, J. (2002). SSO Architectures. In Security, International Conference, InfraSec 2002 (pp. 40-58). Retrieved from http://www.springerlink.com/content/806c0atpq9ab0nx4/.

Costa, D. (2002, October 15). Passport vs. liberty. Retrieved from http://www.pcmag.com/article2/0,2817,1172120,00.asp.
IBM. (2010, September 10). Rational app developer. Retrieved from http://publib.boulder.ibm.com/infocenter/radhelp/v8r5/index.jsp?topic=/com.ibm.websphere.wlp.nd.multiplatform.doc/topics/cwlp_authentication.html.

Kormann, D., & Rubin, A. (2000). Risks of the Passport SSO Protocol. Computer Networks, Elsevier Science Press, 33, 54. Retrieved from http://avirubin.com/passport.html.

Varney, C. (2003, November 15). Security liability . Retrieved from http://www.projectliberty.org/specs/final_privacy_security_best_practices.pdf

Wang, R. (2012, May). In Rui Wang (Chair). Commercially deployed single-sign-on web services. , San Francisco. Retrieved from http://www.computer.org/cms/Computer.org/CPS/Security Symposium/2012/2012_IEEE_SP_Wang.mov
-----------------------
10

10