{
  "guid": "8e56bfbc-4bab-548d-8e15-d0de16c125e7",
  "id": 766,
  "date": "2024-12-30T00:50:00+01:00",
  "start": "00:50",
  "duration": "00:40",
  "room": "Stage HUFF",
  "slug": "38c3-omg-wtf-sso-a-beginner-s-guide-to-sso-mis-configuration",
  "url": "https://events.ccc.de/congress/2024/hub/de/event/omg-wtf-sso-a-beginner-s-guide-to-sso-mis-configuration/",
  "title": "OMG WTF SSO - A beginner's guide to SSO (mis)configuration",
  "subtitle": null,
  "language": "en",
  "track": null,
  "type": "Talk 40 (30min +10 Q&A)",
  "abstract": "A couple years ago I knew basically nothing about Single Sign-On but now I'm talking at 38c3 about it! Come find out how you too can go from beginner to the question-asker who protects your hackerspace/company/etc. from bad SSO implementations.",
  "description": "Single Sign-On (SSO) is sold as a way to\r\n\u2022\tcentralize managing your organization\u2019s users,\r\n\u2022\tmake life easier for your colleagues, and\r\n\u2022\tenforce consistent security standards.\r\nBut SSO protocols are just ways for an identity provider to share information about an authenticated identity with another service. Me having a way to tell my vendor \u201cyeah, that\u2019s Bob\u201d doesn\u2019t tell me what the vendor does with this information, or if the vendor always asks me who\u2019s coming in the door.\r\nA bad SSO implementation can make you think you\u2019re safer, while hiding all the new and fun things that have gone wrong.\r\nTo get the most out of implementing SSO, I need to know what I\u2019m trying to accomplish and what steps I need to follow to get there. To illustrate why SSO needs to be set up carefully, for each of the things you need to do right, I\u2019ll give you some fun examples of creative ways you and your vendor can do this wrong. We all learn from failure, right???\r\nI\u2019m sharing this info because this year I got deeply involved in the SSO setup for several vendors at work. It turns out that I\u2019m good at asking weird questions, and it\u2019s an extremely valuable thing to do. If you know how things should be, then you know where they could be broken, and you can ask your vendors (and your colleagues!) \u201cweird questions\u201d before an adversary does.",
  "logo": null,
  "persons": [
    {
      "guid": "ae9701d0-951d-5022-ab33-9e3b826ad192",
      "name": "Adina Bogert-O'Brien",
      "public_name": "Adina Bogert-O'Brien",
      "avatar": "https://cfp.cccv.de/media/avatars/2024_RVDiEQK.png",
      "biography": null,
      "url": "https://events.ccc.de/congress/2024/hub/de/user/speaker_ae9701d0-951d-5022-ab33-9e3b826ad192/"
    }
  ],
  "links": [],
  "origin_url": "https://cfp.cccv.de/38c3-community-stages/talk/M9EHE8/",
  "feedback_url": "https://cfp.cccv.de/38c3-community-stages/talk/M9EHE8/feedback/"
}