How To Manage Your Web 2.0 Account On A Single Sign On On A Pc Or Mac Or Ipad (For A Free) On A Password Protected Computer (For Free) (For An Ipad) (Free) (Unhack)
|
|
|
- Hilary Webster
- 3 years ago
- Views:
Transcription
1 Single Sign-On for the Internet: A Security Story eugene@tsyrklevich.name vlad902@gmail.com BlackHat USA, Las Vegas 2007
2 How do you manage your 169 Web 2.0 accounts today?
3 Does your SSO consist of A login (e.g. johndoe) + 2 passwords (one insecure for web 2.0 sites and one secure for banking sites)?
4 Attack #1 a. Fail a user s login b. Observe the user try every single combination of their username and password, including the secure password..
5 Lesson #1 Complexity breeds insecurity
6 One login to rule them all a story about reducing complexity
7 Proves that a user owns a URL You get to choose who manages your identity e.g. or
8 Answers the who? question (authentication) are you john.doe.name? Does NOT answer the what? (authorization) is john.doe.name allowed to access this page?
9 How? (demo)
10
11
12
13
14 That was easy!
15 Oh. Never mind.
16 Let s start at the beginning
17 Attack #2 Which one are you? file:///dev/null
18 Lesson #2 Flexibility and security do not get along (or, why it s important to be less flexible and more paranoid)
19 Everybody loves crypto associate mode
20 Why is crypto required? to protect request & response URLs
21 Shared symmetric key is generated using Diffie-Hellman
22 Attack #3 - Diffie-Hellman is vulnerable to man-in-the-middle attacks! The spec suggests running DH over https to improve protocol security So what s the point of using DH in the first place?
23 Lesson #3 Home brewed crypto is a no no (or, why you should stick to https)
24 Where are you going?
25 This way! No, that way! Location: openid.assoc_handle=%7bhmac-sha1%7d%7b4..& openid.identity=http%3a%2f%2fjohn.doe.name%2f& openid.mode=checkid_setup& openid.return_to=http%3a%2f%2www.somesite.com%2f& openid.trust_root=http%3a%2f%2www.somesite.com%2f
26 Attack #4a Phishing with malicious RPs
27 Attack #4b Phishing with malicious URL hosts
28 Lesson #4 Phishers 1 OpenID 0 (or, why Johnny will never learn to read URLs)
29 Let me in!
30 Once signed in, you will no longer need to re-enter your password for other OpenID enabled sites Convenient, eh?
31 In other words your identity provider receives and processes ALL your login requests on your behalf privacy, anyone?
32 Lesson #5 OpenID makes privacy difficult (or, why some paranoid users might want to use one OpenID login per site)
33 Not another redirect!
34 Attack #6 Replay attack Location: openid.assoc_handle=%7bhmac-ha1%7d%7b47bb..& openid.identity=http%3a%2f%2fjohn.doe.name%2f& openid.mode=id_res& openid.return_to=http%3a%2f%2www.somesite.com& openid.sig=vbuynd6n39ss8ikpkl19rt83o%2f4%3d& openid.signed=mode%2cidentity%2creturn_to& nonce=wvso75kh
35 Problems with Nonces a. Not part of the OpenID spec (v1) b. Do not actually protect against active attackers!
36 Lesson #6 Nonces are nonsense (or, why you must be drinking absolut kool-aid if you believe nonces will protect you against an active attacker)
37 I am secure once I am logged in though, right?
38 Attack #7 Cross-site request forgery <html><body> <iframe id="login" src=" width="0" height="0"></iframe> <iframe id= transfer" src=" width="0" height="0"></iframe> </body></html>
39 Lesson #7 OpenID robs you of control (or IdP, not RP, makes the security decisions)
40 Is it really all that bad?! No! OpenID can make your logins far more secure than they are today!
41 How?! Only one service to secure so we can afford to use Client-side certificates SecurID Smartcards
42 Lesson #8 There is only 1 front door with OpenID (or, how I got over my privacy and learnt to love OpenID)
43 Lessons Learnt 1. Complexity breeds insecurity 2. Flexibility and security do not get along 3. Home brewed crypto is a no no 4. Phishers 1 OpenID 0 5. OpenID makes privacy difficult 6. Nonces are nonsense 7. OpenID robs you of control 8. There is only 1 front door with OpenID
44 Is OpenID doomed? Absolutely not It s a great system solving a very real problem But its security and privacy concerns need further thought
45 Thanks! Try it today.
46
Single Sign-On for the Internet: A Security Story. Eugene Tsyrklevich eugene@tsyrklevich.name Vlad Tsyrklevich vlad902@gmail.com
Single Sign-On for the Internet: A Security Story Eugene Tsyrklevich eugene@tsyrklevich.name Vlad Tsyrklevich vlad902@gmail.com BlackHat USA, Las Vegas 2007 Introduction With the explosion of Web 2.0 technology,
Computer Systems Security 2013/2014. Single Sign-On. Bruno Maia ei09095@fe.up.pt. Pedro Borges ei09063@fe.up.pt
Computer Systems Security 2013/2014 Single Sign-On Bruno Maia ei09095@fe.up.pt Pedro Borges ei09063@fe.up.pt December 13, 2013 Contents 1 Introduction 2 2 Explanation of SSO systems 2 2.1 OpenID.................................
Addressing threats to real-world identity management systems
Addressing threats to real-world identity management systems Wanpeng Li and Chris J Mitchell Information Security Group Royal Holloway, University of London Agenda Single sign-on and identity management
2015-11-30. Web Based Single Sign-On and Access Control
0--0 Web Based Single Sign-On and Access Control Different username and password for each website Typically, passwords will be reused will be weak will be written down Many websites to attack when looking
Lecture Notes for Advanced Web Security 2015
Lecture Notes for Advanced Web Security 2015 Part 6 Web Based Single Sign-On and Access Control Martin Hell 1 Introduction Letting users use information from one website on another website can in many
Addressing threats to real-world identity management systems
Addressing threats to real-world identity management systems Wanpeng Li and Chris J Mitchell Information Security Group Royal Holloway, University of London Agenda Single sign-on and identity management
Security and Privacy Concern for Single Sign-on Protocols
COMP116 Computer Security 2015 Final Project Security and Privacy Concern for Single Sign-on Protocols Name: Fangyuan Xu Login: fxu01 Mentor: Ming Chow Due Date: 12/15/2015 1 Abstract Nowadays, Single
The Devil is Phishing: Rethinking Web Single Sign On Systems Security. Chuan Yue USENIX Workshop on Large Scale Exploits
The Devil is Phishing: Rethinking Web Single Sign On Systems Security Chuan Yue USENIX Workshop on Large Scale Exploits and Emergent Threats (LEET 2013) Web Single Sign On (SSO) systems Sign in multiple
OPENID AUTHENTICATION SECURITY
OPENID AUTHENTICATION SECURITY Erik Lagercrantz and Patrik Sternudd Uppsala, May 17 2009 1 ABSTRACT This documents gives an introduction to OpenID, which is a system for centralised online authentication.
SPRESSO: A Secure, Privacy-Respecting Single Sign-On System for the Web
SPRESSO: A Secure, Privacy-Respecting Single Sign-On System for the Web Daniel Fett University of Trier, Germany fett@uni-trier.de Ralf Küsters University of Trier, Germany kuesters@uni-trier.de Guido
Using Foundstone CookieDigger to Analyze Web Session Management
Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.
OpenID and identity management in consumer services on the Internet
OpenID and identity management in consumer services on the Internet Kari Helenius Helsinki University of Technology kheleniu@cc.hut.fi Abstract With new services emerging on the Internet daily, users need
OpenLogin: PTA, SAML, and OAuth/OpenID
OpenLogin: PTA, SAML, and OAuth/OpenID Ernie Turner Chris Fellows RightNow Technologies, Inc. Why should you care about these features? Why should you care about these features? Because users hate creating
Cloud Computing. Chapter 5 Identity as a Service (IDaaS)
Cloud Computing Chapter 5 Identity as a Service (IDaaS) Learning Objectives Describe challenges related to ID management. Describe and discuss single sign-on (SSO) capabilities. List the advantages of
Federated Identity and Single-Sign On
CS 6393 Lecture 5 Federated Identity and Single-Sign On Prof. Ravi Sandhu Executive Director and Endowed Chair February 15, 2013 ravi.sandhu@utsa.edu www.profsandhu.com Ravi Sandhu 1 The Web Today User
seclab University of California, Santa Barbara Northwestern University! September 17th, 2014! RAID 2014 Authentication & Privacy
THE COMPUTER SECURITY GROUP AT UC SANTA BARBARA Protecting Web-based Single Sign-on Protocols against Relying Party Impersonation Attacks through a Dedicated Bi-directional Authenticated Channel Yinzhi
AccountView. Single Sign-On Guide
AccountView Single Sign-On Guide 2014 Morningstar. All Rights Reserved. AccountView Version: 1.4 Document Version: 2 Document Issue Date: March 09, 2013 Technical Support: (866) 856-4951 Telephone: (781)
JVA-122. Secure Java Web Development
JVA-122. Secure Java Web Development Version 7.0 This comprehensive course shows experienced developers of Java EE applications how to secure those applications and to apply best practices with regard
An Identity Management Survey. on Cloud Computing
Int. Journal of Computing and Optimization, Vol. 1, 2014, no. 2, 63-71 HIKARI Ltd, www.m-hikari.com http://dx.doi.org/10.12988/ijco.2014.458 An Identity Management Survey on Cloud Computing Ardi BENUSI
Contemporary Web Application Attacks. Ivan Pang Senior Consultant Edvance Limited
Contemporary Web Application Attacks Ivan Pang Senior Consultant Edvance Limited Agenda How Web Application Attack impact to your business? What are the common attacks? What is Web Application Firewall
Web Security. Crypto (SSL) Client security Server security 2 / 40. Web Security. SSL Recent Changes in TLS. Protecting the Client.
1 / 40 Crypto () Client security Server security 2 / 40 Trusting The Server s Client SET The Failure of SET Aside: The SET Root Certificate The Client s Server Who Issues Web Certificates? Mountain America
Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications
Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications Ray Lai, Intuit TS-5358 Share experience how to detect and defend security vulnerabilities in Web 2.0 applications using
Designing federated identity management architectures for addressing the recent attacks against online financial transactions.
Designing federated identity management architectures for addressing the recent attacks against online financial transactions. Dr. Christos K. Dimitriadis Security Officer INTRALOT S.A. Scope and Agenda
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications. Slides by Connor Schnaith
A Server and Browser-Transparent CSRF Defense for Web 2.0 Applications Slides by Connor Schnaith Cross-Site Request Forgery One-click attack, session riding Recorded since 2001 Fourth out of top 25 most
Egnyte Single Sign-On (SSO) Installation for OneLogin
Egnyte Single Sign-On (SSO) Installation for OneLogin To set up Egnyte so employees can log in using SSO, follow the steps below to configure OneLogin and Egnyte to work with each other. 1. Set up OneLogin
Web Application Attacks and Countermeasures: Case Studies from Financial Systems
Web Application Attacks and Countermeasures: Case Studies from Financial Systems Dr. Michael Liu, CISSP, Senior Application Security Consultant, HSBC Inc Overview Information Security Briefing Web Applications
Case Study: SSO for All: SSOCircle Makes Single Sign-On Available to Everyone
Case Study: SSO for All: SSOCircle Makes Single Sign-On Available to Everyone Although single sign-on (SSO) technology based on Liberty standards is being rapidly adopted by businesses, governments and
Gateway Apps - Security Summary SECURITY SUMMARY
Gateway Apps - Security Summary SECURITY SUMMARY 27/02/2015 Document Status Title Harmony Security summary Author(s) Yabing Li Version V1.0 Status draft Change Record Date Author Version Change reference
Yinzhi Cao, Yan Shoshitaishvili, Kevin Borgolte, Christopher Kruegel, Giovanni Vigna, and Yan Chen
Protecting Web-based Single Sign-on Protocols against Relying Party Impersonation Attacks through a Dedicated Bi-directional Authenticated Secure Channel Yinzhi Cao, Yan Shoshitaishvili, Kevin Borgolte,
Web Services and Federated Identity Management
Web Services and Federated Identity Management Birgit Pfitzmann, bpf@zurich.ibm.com with Thomas Gross, Ahmad Sadeghi DIMACS, May 6, 2005 www.zurich.ibm.com What s New about Federated Identity Management?
Mobile Security. Policies, Standards, Frameworks, Guidelines
Mobile Security Policies, Standards, Frameworks, Guidelines Guidelines for Managing and Securing Mobile Devices in the Enterprise (SP 800-124 Rev. 1) http://csrc.nist.gov/publications/drafts/800-124r1/draft_sp800-124-rev1.pdf
Finding and Preventing Cross- Site Request Forgery. Tom Gallagher Security Test Lead, Microsoft
Finding and Preventing Cross- Site Request Forgery Tom Gallagher Security Test Lead, Microsoft Agenda Quick reminder of how HTML forms work How cross-site request forgery (CSRF) attack works Obstacles
Authentication. Agenda. IT Security course Lecture April 14 th 2003. Niels Christian Juul 2. April 14th, 2003
Authentication IT Security course Lecture April 14 th 2003 Niels Christian Juul Computer Science, building 42.1 Roskilde University Universitetsvej 1 P.O. Box 260 DK-4000 Roskilde Denmark Phone: +45 4674
Evaluation of different Open Source Identity management Systems
Evaluation of different Open Source Identity management Systems Ghasan Bhatti, Syed Yasir Imtiaz Linkoping s universitetet, Sweden [ghabh683, syeim642]@student.liu.se 1. Abstract Identity management systems
Perceptive Experience Single Sign-On Solutions
Perceptive Experience Single Sign-On Solutions Technical Guide Version: 2.x Written by: Product Knowledge, R&D Date: January 2016 2016 Lexmark International Technology, S.A. All rights reserved. Lexmark
Dell One Identity Cloud Access Manager 8.0.1 - How to Develop OpenID Connect Apps
Dell One Identity Cloud Access Manager 8.0.1 - How to Develop OpenID Connect Apps May 2015 This guide includes: What is OAuth v2.0? What is OpenID Connect? Example: Providing OpenID Connect SSO to a Salesforce.com
The Password Problem Will Only Get Worse
The Password Problem Will Only Get Worse New technology for proving who we are Isaac Potoczny-Jones Galois & SEQRD ijones@seqrd.com @SyntaxPolice Goals & Talk outline Update the group on authentication
Extending APS Packages with Single Sign On. Brian Spector, CEO, CertiVox / Gene Myers, VP Engineering, CertiVox
Extending APS Packages with Single Sign On Brian Spector, CEO, CertiVox / Gene Myers, VP Engineering, CertiVox Introducing APS 2.0 A Platform for Integration APS Dynamic UI HTML5 Extensibility Certified
Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 10 Authentication and Account Management
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 10 Authentication and Account Management Objectives Describe the three types of authentication credentials Explain what single sign-on
Network Security Essentials Chapter 5
Network Security Essentials Chapter 5 Fourth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 5 Transport-Level Security Use your mentality Wake up to reality From the song, "I've Got
WebCallerID: Leveraging cellular networks for Web authentication
Journal of Computer Security 19 (2011) 869 893 869 DOI 10.3233/JCS-2011-0424 IOS Press WebCallerID: Leveraging cellular networks for Web authentication Francis Hsu a, Hao Chen a, and Sridhar Machiraju
Copyright: WhosOnLocation Limited
How SSO Works in WhosOnLocation About Single Sign-on By default, your administrators and users are authenticated and logged in using WhosOnLocation s user authentication. You can however bypass this and
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER
SESSION IDENTIFIER ARE FOR NOW, PASSWORDS ARE FOREVER XSS-BASED ABUSE OF BROWSER PASSWORD MANAGERS Ben Stock, Martin Johns, Sebastian Lekies Browser choices Full disclosure: Ben was an intern with Microsoft
To set up Egnyte so employees can log in using SSO, follow the steps below to configure VMware Horizon and Egnyte to work with each other.
w w w. e g n y t e. c o m Egnyte Single Sign-On (SSO) Installation for VMware Horizon To set up Egnyte so employees can log in using SSO, follow the steps below to configure VMware Horizon and Egnyte to
Integrating Moodle with an external tool
MuchLearning May 26 & 29, 2012 About me Programmer/Analyst at MuchLearning developed integration with the MuchLearning platform developed OpenID provider plugin for Moodle developed OAuth authentication
Negotiating Trust in Identity Metasystem
Negotiating Trust in Identity Metasystem Mehmud Abliz Department of Computer Science University of Pittsburgh Pittsburgh, Pennsylvania 15260 mehmud@cs.pitt.edu Abstract Many federated identity management
SAML-Based SSO Solution
About SAML SSO Solution, page 1 SAML-Based SSO Features, page 2 Basic Elements of a SAML SSO Solution, page 2 SAML SSO Web Browsers, page 3 Cisco Unified Communications Applications that Support SAML SSO,
Egnyte Single Sign-On (SSO) Configuration for Active Directory Federation Services (ADFS)
w w w. e g n y t e. c o m Egnyte Single Sign-On (SSO) Configuration for Active Directory Federation Services (ADFS) To set up ADFS so that your employees can access Egnyte using their ADFS credentials,
SECURITY ANALYSIS OF A SINGLE SIGN-ON MECHANISM FOR DISTRIBUTED COMPUTER NETWORKS
SECURITY ANALYSIS OF A SINGLE SIGN-ON MECHANISM FOR DISTRIBUTED COMPUTER NETWORKS Abstract: The Single sign-on (SSO) is a new authentication mechanism that enables a legal user with a single credential
Application Security Testing. Generic Test Strategy
Application Security Testing Generic Test Strategy Page 2 of 8 Contents 1 Introduction 3 1.1 Purpose: 3 1.2 Application Security Testing: 3 2 Audience 3 3 Test Strategy guidelines 3 3.1 Authentication
Smart OpenID: A Smart Card Based OpenID Protocol
Smart OpenID: A Smart Card Based OpenID Protocol Andreas Leicher 1, Andreas U. Schmidt 1, and Yogendra Shah 2 1 Novalyst IT AG, Robert-Bosch-Str. 38, 61184 Karben, Germany {andreas.leicher,andreas.schmidt}@novalyst.de
Threat Modeling an Identity Management System for Mobile Internet
Threat Modeling an Identity Management System for Mobile Internet Cristina K. Dominicini 1, Marcos A. Simplício Jr. 1, Rony R. M. Sakuragui 1, Tereza C. M. B. Carvalho 1, Mats Näslund 2, and Makan Pourzandi
Data Breaches and Web Servers: The Giant Sucking Sound
Data Breaches and Web Servers: The Giant Sucking Sound Guy Helmer CTO, Palisade Systems, Inc. Lecturer, Iowa State University @ghelmer Session ID: DAS-204 Session Classification: Intermediate The Giant
INTEGRATION GUIDE. DIGIPASS Authentication for Salesforce using IDENTIKEY Federation Server
INTEGRATION GUIDE DIGIPASS Authentication for Salesforce using IDENTIKEY Federation Server Disclaimer Disclaimer of Warranties and Limitation of Liabilities All information contained in this document is
The increasing popularity of mobile devices is rapidly changing how and where we
Mobile Security BACKGROUND The increasing popularity of mobile devices is rapidly changing how and where we consume business related content. Mobile workforce expectations are forcing organizations to
Absorb Single Sign-On (SSO) V3.0
Absorb Single Sign-On (SSO) V3.0 Overview Absorb allows single sign-on (SSO) with third-party systems, regardless of the programming language. SSO is made secure by a series of calls (between Absorb and
1. Introduction. 2. Web Application. 3. Components. 4. Common Vulnerabilities. 5. Improving security in Web applications
1. Introduction 2. Web Application 3. Components 4. Common Vulnerabilities 5. Improving security in Web applications 2 What does World Wide Web security mean? Webmasters=> confidence that their site won
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE. Mihir Bellare UCSD 1
KEY DISTRIBUTION: PKI and SESSION-KEY EXCHANGE Mihir Bellare UCSD 1 The public key setting Alice M D sk[a] (C) Bob pk[a] C C $ E pk[a] (M) σ $ S sk[a] (M) M, σ Vpk[A] (M, σ) Bob can: send encrypted data
Contents. Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008
Identity Assurance (Scott Rea Dartmouth College) IdM Workshop, Brisbane Australia, August 19, 2008 Contents Authentication and Identity Assurance The Identity Assurance continuum Plain Password Authentication
TRIPwire HSIN Federation:
TRIPwire HSIN Federation: Reference Guide TRIPwire, in coordination with the Homeland Security Information Network (HSIN), is pleased to announce a federated partnership and the introduction of a single
THE DEPUTIES ARE STILL CONFUSED RICH LUNDEEN
THE DEPUTIES ARE STILL CONFUSED RICH LUNDEEN Hi my name is Rich I have a twi1er @webstersprodigy I have a website h1p://webstersprodigy.net What is the same origin policy? Simple answer: content from one
Identity Management with Spring Security. Dave Syer, VMware, SpringOne 2011
Identity Management with Spring Security Dave Syer, VMware, SpringOne 2011 Overview What is Identity Management? Is it anything to do with Security? Some existing and emerging standards Relevant features
An Anti-Phishing mechanism for Single Sign-On based on QR-Code
An Anti-Phishing mechanism for Single Sign-On based on QR-Code Syamantak Mukhopadhyay School of Electronics and Computer Science University of Southampton Southampton, UK sm19g10@ecs.soton.ac.uk David
Egnyte Single Sign-On (SSO) Installation for Okta
w w w. e g n y t e. c o m Egnyte Single Sign-On (SSO) Installation for Okta To set up Egnyte so employees can log in using SSO, follow the steps below to configure Okta and Egnyte to work with each other.
Final Project Report December 9, 2012. Cloud-based Authentication with Native Client Server Applications. Nils Dussart 0961540
Final Project Report December 9, 2012 Cloud-based Authentication with Native Client Server Applications. Nils Dussart 0961540 CONTENTS Project Proposal... 4 Project title... 4 Faculty Advisor... 4 Introduction...
Mid-Project Report August 14 th, 2012. Nils Dussart 0961540
Mid-Project Report August 14 th, 2012 Nils Dussart 0961540 CONTENTS Project Proposal... 3 Project title... 3 Faculty Advisor... 3 Project Scope and Individual Student Learning Goals... 3 Proposed Product
MANAGED SECURITY TESTING
MANAGED SECURITY TESTING SERVICE LEVEL COMPARISON External Network Testing (EVS) Scanning Basic Threats Penetration Testing Network Vulnerability Scan Unauthenticated Web App Scanning Validation Of Scan
Enhanced Security for Online Banking
Enhanced Security for Online Banking MidSouth Bank is focused on protecting your personal and account information at all times. As instances of internet fraud increase, it is no longer sufficient to use
2012. Springer. Institutional Repository. This document is published in:
Institutional Repository This document is published in: Multimedia Tools and Applications (2014) pp. 159 176 DOI:10.1007/s11042-012-1155-4 2012. Springer Analysis of privacy vulnerabilities in single sign-on
In fact, one of the biggest challenges that the evolution of the Internet is facing today, is related to the question of Identity Management [1].
![In fact, one of the biggest challenges that the evolution of the Internet is facing today, is related to the question of Identity Management [1].](/thumbs/33/16163095.jpg "In fact, one of the biggest challenges that the evolution of the Internet is facing today, is related to the question of Identity Management [1].")
1. Introduction Using the Internet has become part of the daily habits of a constantly growing number of people, and there are few human activities that can be performed without accessing the enormous
Digital Identity Management
Digital Identity Management Roohul Halim Syed Atif Shaharyar Email: {rooha433, syesh740}@student.liu.se Supervisor: Anna Vapen, {annva@ida.liu.se} Project Report for Information Security Course Linköpings
QR-SSO : Towards a QR-Code based Single Sign-On system
QR-SSO : Towards a QR-Code based Single Sign-On system Syamantak Mukhopadhyay School of Electronics and Computer Science University of Southampton Southampton, UK sm19g10@ecs.soton.ac.uk David Argles School
Logout in Single Sign-on Systems
Logout in Single Sign-on Systems Sanna Suoranta, Asko Tontti, Joonas Ruuskanen, Tuomas Aura IFIP IDMAN, London, UK, 8-9.4.2013 Logout in Single Sign-on Systems Motivation Single sign-on (SSO) systems SSO
From the Intranet to Mobile. By Divya Mehra and Stian Thorgersen
ENTERPRISE SECURITY WITH KEYCLOAK From the Intranet to Mobile By Divya Mehra and Stian Thorgersen PROJECT TIMELINE AGENDA THE OLD WAY Securing monolithic web app relatively easy Username and password
How To Use Salesforce Identity Features
Identity Implementation Guide Version 35.0, Winter 16 @salesforcedocs Last updated: October 27, 2015 Copyright 2000 2015 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of
An Introduction to User-Managed Access (UMA)
An Introduction to User-Managed Access (UMA) Eve Maler VP Innovation & Emerging Technology eve.maler@forgerock.com @xmlgrrl February 9, 2015 FORGEROCK.COM Some apps are still in the Web 1.0 dark ages Provisioning
MCU Online and MFA (Multi Factor Authentication)
MCU Online and MFA (Multi Factor Authentication) Instructions for enrolling in MFA Security. 1. Type in your account number in the User ID box and press return or click on Log in. Figure A: 2. Enter your
Getting Started with AD/LDAP SSO
Getting Started with AD/LDAP SSO Active Directory and LDAP single sign- on (SSO) with Syncplicity Business Edition accounts allows companies of any size to leverage their existing corporate directories
Single Sign On (SSO) Implementation Manual. For Connect 5 & MyConnect Sites
Single Sign On (SSO) Implementation Manual For Connect 5 & MyConnect Sites Version 6 Release 5.7 September 2013 1 What is Blackboard Connect Single Sign On?... 3 How it Works... 3 Drawbacks to Using Single
Identity Federation Broker for Service Cloud
2010 International Conference on Sciences Identity Federation Broker for Cloud He Yuan Huang 1, Bin Wang 1, Xiao Xi Liu 1, Jing Min Xu 1 1 IBM Research China {huanghey, wangbcrl, liuxx, xujingm}@cn.ibm.com
What is Web Security? Motivation
brucker@inf.ethz.ch http://www.brucker.ch/ Information Security ETH Zürich Zürich, Switzerland Information Security Fundamentals March 23, 2004 The End Users View The Server Providers View What is Web
Dirty use of USSD codes in cellular networks
.. Dirty use of USSD codes in cellular networks Ravishankar Borgaonkar Security in Telecommunications, Technische Universität Berlin TelcoSecDay, Heidelberg, 12th March 2013 Agenda USSD codes and services
How to create a SP and a IDP which are visible across tenant space via Config files in IS
How to create a SP and a IDP which are visible across tenant space via Config files in IS This Documentation is explaining the way to create a SP and IDP which works are visible to all the tenant domains.
INTEGRATION GUIDE. DIGIPASS Authentication for Google Apps using IDENTIKEY Federation Server
INTEGRATION GUIDE DIGIPASS Authentication for Google Apps using IDENTIKEY Federation Server Disclaimer Disclaimer of Warranties and Limitation of Liabilities All information contained in this document
How to Configure Outlook 2010 E-mail Client for Exchange
LAUSD IT Help Desk How to Configure Outlook 2010 E-mail Client for Exchange (03/04/2012) LAUSD IT Help Desk 333 S. Beaudry Ave. 9 th Floor Phone 213.241.5200 Table of Contents Configure Outlook 2010 for
Web Payment Security. A discussion of methods providing secure communication on the Internet. Zhao Huang Shahid Kahn
Web Payment Security A discussion of methods providing secure communication on the Internet Group Members: Peter Heighton Zhao Huang Shahid Kahn 1. Introduction Within this report the methods taken to
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
Transport Layer Security Protocols
SSL/TLS 1 Transport Layer Security Protocols Secure Socket Layer (SSL) Originally designed to by Netscape to secure HTTP Version 2 is being replaced by version 3 Subsequently became Internet Standard known
Identity Management. Audun Jøsang University of Oslo. NIS 2010 Summer School. September 2010. http://persons.unik.no/josang/
Identity Management Audun Jøsang University of Oslo NIS 2010 Summer School September 2010 http://persons.unik.no/josang/ Outline Identity and identity management concepts Identity management models User-centric
Safewhere*Identify 3.4. Release Notes
Safewhere*Identify 3.4 Release Notes Safewhere*identify is a new kind of user identification and administration service providing for externalized and seamless authentication and authorization across organizations.
SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities. Yuchen Zhou and David Evans Presented by Yishan
SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities Yuchen Zhou and David Evans Presented by Yishan Background Single Sign-On (SSO) OAuth Credentials Vulnerabilities Single
Kerberos. Guilin Wang. School of Computer Science, University of Birmingham G.Wang@cs.bham.ac.uk
Kerberos Guilin Wang School of Computer Science, University of Birmingham G.Wang@cs.bham.ac.uk 1 Entity Authentication and Key Exchange In the last talk, we discussed key exchange and reviewed some concrete
Easy, Trusted Online Service Access
SOLUTIONS BRIEF Easy, Trusted Online Service Access Making online services more convenient, secure and cost-effective. For many online services, forgotten passwords and new credential set up are the two
New Brunswick Internal Services Agency. RSA Self-Service Console User Guide
New Brunswick Internal Services Agency RSA Self-Service Console User Guide Version: 1.0 Created: November 27, 2013 Modified: November 27, 2013 Table of Contents Introduction...1 Logging on to the RSA Self-Service
EECS 588: Computer and Network Security. Introduction January 14, 2014
EECS 588: Computer and Network Security Introduction January 14, 2014 Today s Class Welcome! Goals for the course Topics, what interests you? Introduction to security research Components of your grade
Basic Security Considerations for Email and Web Browsing
Basic Security Considerations for Email and Web Browsing There has been a significant increase in spear phishing and other such social engineering attacks via email in the last quarter of 2015, with notable
SSOScan: Automated Testing of Web Applications for Single Sign-On vulnerabilities
123456 SSOScan: Automated Testing of Web Applications for Single Sign-On vulnerabilities Yuchen Zhou David Evans 1 http://www.ssoscan.org/ Single Sign-On Service 2 Single Sign-On Workflow Integrator (e.g.,
Reparing HTTP authentication for Web security
Reparing HTTP authentication for Web security Yutaka OIWA 1 Overview This position paper proposes improvement efforts for HTTP authentication/authorization mechanisms, to solve various current problems
Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you
Transport Level Security
Transport Level Security Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/