Analysing the Security of Google’s Implementation of OpenID Connect

Wanpeng Li; Chris Mitchell

doi:10.1007/978-3-319-40667-1_18

Analysing the Security of Google’s Implementation of OpenID Connect

Wanpeng Li^* (Corresponding Author), Chris Mitchell

^*Corresponding author for this work

Computing Science

Research output: Chapter in Book/Report/Conference proceeding › Published conference contribution

26 Citations (Scopus)

13 Downloads (Pure)

Abstract

Many millions of users routinely use Google to log in to relying party (RP) websites supporting Google’s OpenID Connect service. OpenID Connect builds an identity layer on top of the OAuth 2.0 protocol, which has itself been widely adopted to support identity management. OpenID Connect allows an RP to obtain authentication assurances regarding an end user. A number of authors have analysed OAuth 2.0 security, but whether OpenID Connect is secure in practice remains an open question. We report on a large-scale practical study of Google’s implementation of OpenID Connect, involving forensic examination of 103 RP websites supporting it. Our study reveals widespread serious vulnerabilities of a number of types, many allowing an attacker to log in to an RP website as a victim user. These issues appear to be caused by a combination of Google’s design of its OpenID Connect service and RP developers making design decisions sacrificing security for ease of implementation. We give practical recommendations for both RPs and OPs to help improve the security of real world OpenID Connect systems.

Original language	English
Title of host publication	International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Subtitle of host publication	DIMVA 2016
Editors	J Callabero, U Zurutuza , R Rodríguez
Place of Publication	Cham
Publisher	Springer
Pages	357-376
Number of pages	19
ISBN (Electronic)	978-3-319-40667-1
ISBN (Print)	978-3-319-40666-4
DOIs	https://doi.org/10.1007/978-3-319-40667-1_18
Publication status	Published - 12 Jun 2016

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer
Volume	9721
ISSN (Print)	0302-9743

Access to Document

10.1007/978-3-319-40667-1_18Licence: Unspecified

atsogi2Accepted author manuscript, 204 KBLicence: Unspecified

Wanpeng Li
- School of Natural & Computing Sciences, Computing Science - Lecturer
- Cybersecurity and Privacy
Person: Academic

Cite this

Li, W., & Mitchell, C. (2016). Analysing the Security of Google’s Implementation of OpenID Connect. In J. Callabero, U. Zurutuza , & R. Rodríguez (Eds.), International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment: DIMVA 2016 (pp. 357-376). (Lecture Notes in Computer Science; Vol. 9721). Springer . https://doi.org/10.1007/978-3-319-40667-1_18

Analysing the Security of Google’s Implementation of OpenID Connect. / Li, Wanpeng (Corresponding Author); Mitchell, Chris.
International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment: DIMVA 2016. ed. / J Callabero; U Zurutuza ; R Rodríguez . Cham: Springer , 2016. p. 357-376 (Lecture Notes in Computer Science; Vol. 9721).

Research output: Chapter in Book/Report/Conference proceeding › Published conference contribution

Li, W & Mitchell, C 2016, Analysing the Security of Google’s Implementation of OpenID Connect. in J Callabero, U Zurutuza & R Rodríguez (eds), International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment: DIMVA 2016. Lecture Notes in Computer Science, vol. 9721, Springer , Cham, pp. 357-376. https://doi.org/10.1007/978-3-319-40667-1_18

@inproceedings{ee5fac7389604897b521fecfb76e955a,

title = "Analysing the Security of Google{\textquoteright}s Implementation of OpenID Connect",

abstract = "Many millions of users routinely use Google to log in to relying party (RP) websites supporting Google{\textquoteright}s OpenID Connect service. OpenID Connect builds an identity layer on top of the OAuth 2.0 protocol, which has itself been widely adopted to support identity management. OpenID Connect allows an RP to obtain authentication assurances regarding an end user. A number of authors have analysed OAuth 2.0 security, but whether OpenID Connect is secure in practice remains an open question. We report on a large-scale practical study of Google{\textquoteright}s implementation of OpenID Connect, involving forensic examination of 103 RP websites supporting it. Our study reveals widespread serious vulnerabilities of a number of types, many allowing an attacker to log in to an RP website as a victim user. These issues appear to be caused by a combination of Google{\textquoteright}s design of its OpenID Connect service and RP developers making design decisions sacrificing security for ease of implementation. We give practical recommendations for both RPs and OPs to help improve the security of real world OpenID Connect systems.",

author = "Wanpeng Li and Chris Mitchell",

year = "2016",

month = jun,

day = "12",

doi = "10.1007/978-3-319-40667-1_18",

language = "English",

isbn = "978-3-319-40666-4",

series = "Lecture Notes in Computer Science",

publisher = "Springer ",

pages = "357--376",

editor = "J Callabero and {Zurutuza }, U and {Rodr{\'i}guez }, R",

booktitle = "International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment",

}

TY - GEN

T1 - Analysing the Security of Google’s Implementation of OpenID Connect

AU - Li, Wanpeng

AU - Mitchell, Chris

PY - 2016/6/12

Y1 - 2016/6/12

N2 - Many millions of users routinely use Google to log in to relying party (RP) websites supporting Google’s OpenID Connect service. OpenID Connect builds an identity layer on top of the OAuth 2.0 protocol, which has itself been widely adopted to support identity management. OpenID Connect allows an RP to obtain authentication assurances regarding an end user. A number of authors have analysed OAuth 2.0 security, but whether OpenID Connect is secure in practice remains an open question. We report on a large-scale practical study of Google’s implementation of OpenID Connect, involving forensic examination of 103 RP websites supporting it. Our study reveals widespread serious vulnerabilities of a number of types, many allowing an attacker to log in to an RP website as a victim user. These issues appear to be caused by a combination of Google’s design of its OpenID Connect service and RP developers making design decisions sacrificing security for ease of implementation. We give practical recommendations for both RPs and OPs to help improve the security of real world OpenID Connect systems.

AB - Many millions of users routinely use Google to log in to relying party (RP) websites supporting Google’s OpenID Connect service. OpenID Connect builds an identity layer on top of the OAuth 2.0 protocol, which has itself been widely adopted to support identity management. OpenID Connect allows an RP to obtain authentication assurances regarding an end user. A number of authors have analysed OAuth 2.0 security, but whether OpenID Connect is secure in practice remains an open question. We report on a large-scale practical study of Google’s implementation of OpenID Connect, involving forensic examination of 103 RP websites supporting it. Our study reveals widespread serious vulnerabilities of a number of types, many allowing an attacker to log in to an RP website as a victim user. These issues appear to be caused by a combination of Google’s design of its OpenID Connect service and RP developers making design decisions sacrificing security for ease of implementation. We give practical recommendations for both RPs and OPs to help improve the security of real world OpenID Connect systems.

U2 - 10.1007/978-3-319-40667-1_18

DO - 10.1007/978-3-319-40667-1_18

M3 - Published conference contribution

SN - 978-3-319-40666-4

T3 - Lecture Notes in Computer Science

SP - 357

EP - 376

BT - International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment

A2 - Callabero, J

A2 - Zurutuza , U

A2 - Rodríguez , R

PB - Springer

CY - Cham

ER -

Analysing the Security of Google’s Implementation of OpenID Connect

Abstract

Publication series

Access to Document

Fingerprint

Profiles

Wanpeng Li

Cite this