User Privacy in OAuth-Based Single Sign-On Systems

Abstract

Web Single Sign-On (SSO) login is a popular alternative to password-based login in current authentication systems. SSO services enable users to use accounts registered with identity providers (IdPs) such as Google and Facebook to login on multiple relying party (RP) websites. Common web SSO deployments are based on the OAuth 2.0 authorization standard which enables RPs to both authenticate users and access a subset of a user's personal information from an IdP. This thesis pursues three goals related to user privacy in OAuth-based web SSO implementations. First, we build OAuthScope, a tool that extracts OAuth protocol data from RP sites. We use it to conduct an empirical investigation of privacy implications for users of OAuth implementations in RP websites most visited by users across five countries. We categorize user data made available by four IdPs (Google, Facebook, Apple, and LinkedIn) and evaluate the types of user data accessed by RPs through these IdPs. Our results reveal considerable variations in the categories and amounts of user data accessed by RPs, including differences across site versions in different countries. Second, to improve the transparency of user data accessed by RPs, we design and implement SSOPrivateEye (SPEye), a browser extension tool to inform users about the privacy consequences of choosing SSO login options. SPEye extracts information about permission requests made by RPs to enable users to compare SSO options before making a login choice.Finally, I would like to thank my family and friends for all their support and motivation throughout my studies. To my parents, Gnanasekaran and Indumathi, and my sister Srinimisha, thanks for encouraging me to pursue a PhD. To my wife Nivethini, thank you for always being there and keeping me motivated throughout this journey. This thesis would not have been possible without their love and support.