Privacy-preserving Web single sign-on: Formal security analysis and design

Abstract Single sign-on (SSO) systems, such as OpenID and OAuth, allow Web sites to delegate user authentication third parties, Facebook or Google. These systems provide a convenient mechanism for users log in ease the burden of sites. Conversely, by integrating SSO they become crucial part security modern Web. So far, it has been hard prove if standards protocols actually meet their goals. particular, need satisfy strong privacy properties. In this thesis, we develop new systematic approach rigorously formally analyze verify properties with Infrastructure Model (WIM), most comprehensive model infrastructure date. Our analyses reveal severe vulnerabilities that lead critical attacks against privacy. We propose fixes our proposals are sufficient establish security. analyses, however, also show even Mozilla’s proposal privacy-preserving system does not its unique goal. To fill gap, use novel system, SPRESSO, indeed enjoys