Analyzing Privacy Implications and Security Vulnerabilities in Single Sign-On Systems: A Case Study on OpenID Connect

• Published in: International journal of advanced computer science & applications 2024, Vol.15 (4)
• Main Authors: Shabi, Mohammed Al, Marie, Rashiq Rafiq
• Format: Article
• Language: English
• Subjects: Access control; Privacy; Security
• ISSN: 2158-107X; 2156-5570
• DOI: 10.14569/IJACSA.2024.0150465

Single Sign-On (SSO) systems have gained popularity for simplifying the login process, enabling users to authenticate through a single identity provider (IDP). However, their widespread adoption raises concerns regarding user privacy, as IDPs like Google or Facebook can accumulate extensive data on user web behavior. This presents a significant challenge for privacy-conscious users seeking to restrict disclosure of their online activities to third-party entities. This paper presents a comprehensive study focused on the OpenID Connect protocol, a widely utilized SSO standard. Our analysis delves into the protocol's operation, identifying security flaws and vulnerabilities across its various stages. Additionally, we systematically examine the privacy implications associated with user access to SSO systems. We offer a detailed account of how easily user information can be accessed, shedding light on potential risks. The findings underscore the imperative to address privacy vulnerabilities within SSO infrastructures. We advocate for proactive measures to enhance system security and safeguard user privacy effectively. By identifying weaknesses in the OpenID Connect protocol and its implementations, stakeholders can implement targeted strategies to mitigate risks and ensure the protection of user data. This research aims to foster a more secure and privacy-respecting environment within the evolving landscape of SSO systems.