The Devil Is Phishing: Rethinking Web Single Sign-On Systems Security

One significant trend in online user authentication is using Web Single Sign-On (SSO) systems. Especially, open Web SSO standards such as OpenID and OAuth are rapidly gaining adoption on the Web, and they enable over one billion user accounts. However, the largescale threat from phishing attacks to real-world Web SSO systems has been significantly underestimated and insufficiently analyzed. In this paper, we (1) pinpoint what are really unique in Web SSO phishing, (2) provide one example to illustrate how the identity providers (IdPs) of Web SSO systems can be spoofed with ease and precision, (3) present a preliminary user study to demonstrate the high effectiveness (20 out of 28, or 71% of participants became “victims”) of Web SSO phishing attacks, and (4) call for a collective effort to effectively defend against the insidious Web SSO phishing attacks.

在线用户认证的一个重要趋势是使用网络单点登录（SSO）系统。特别是，像OpenID和OAuth这样的开放网络SSO标准在网络上迅速得到采用，它们支持超过10亿个用户账户。然而，网络钓鱼攻击对现实世界中的网络SSO系统造成的大规模威胁被严重低估且分析不足。在本文中，我们（1）明确指出网络SSO钓鱼攻击的独特之处，（2）提供一个例子来说明网络SSO系统的身份提供者（IdPs）是如何能够轻易且精准地被伪造的，（3）展示一项初步的用户研究，以证明网络SSO钓鱼攻击的高效性（28人中有20人，即71%的参与者成为“受害者”），以及（4）呼吁共同努力有效抵御这种隐蔽的网络SSO钓鱼攻击。