Third-Party Identity Management Usage on the Web

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8362)


Many websites utilize third-party identity management services to simplify access to their services. Given the privacy and security implications for end users, an important question is how websites select their third-party identity providers and how this impacts the characteristics of the emerging identity management landscape seen by the users. In this paper we first present a novel Selenium-based data collection methodology that identifies and captures the identity management relationships between sites and the intrinsic characteristics of the websites that form these relationships. Second, we present the first large-scale characterization of the third-party identity management landscape and the relationships that makes up this emerging landscape. As a reference point, we compare and contrast our observations with the somewhat more understood third-party content provider landscape. Interesting findings include a much higher skew towards websites selecting popular identity provider sites than is observed among content providers, with sites being more likely to form identity management relationships that have similar cultural, geographic, and general site focus. These findings are both positive and negative. For example, the high skew in usage places greater responsibility on fewer organizations that are responsible for the increased information leakage cost associated with highly aggregated personal information, but also reduces the user’s control of the access to this information.


Identity Management Content Provider Content Delivery Site Rank Popular Site 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Armando, A., Carbone, R., Compagna, L., Cuellar, J., Pellegrino, G., Sorniotti, A.: From multiple credentials to browser-based single sign-on: Are we more secure? In: Camenisch, J., Fischer-Hübner, S., Murayama, Y., Portmann, A., Rieder, C. (eds.) SEC 2011. IFIP AICT, vol. 354, pp. 68–79. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  2. 2.
    Bonneau, J., Herley, C., van Oorschot, P.C., Stajano, F.: The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. In: Proc. IEEE Symposium on S&P (May 2012)Google Scholar
  3. 3.
    Chari, S., Jutla, C., Roy, A.: Universally composable security analysis of oauth v2.0. Technical report, Cryptology ePrint Archive, Report 2011/526 (2011)Google Scholar
  4. 4.
    Dhamija, R., Dusseault, L.: The seven flaws of identity management: Usability and security challenges. IEEE Security & Privacy 6(2), 24–29 (2008)CrossRefGoogle Scholar
  5. 5.
    Gill, P., Arlitt, M., Carlsson, N., Mahanti, A., Williamson, C.: Characterizing organizational use of web-based services: Methodology, challenges, observations, and insights. ACM Transactions on the Web (TWEB) 5(4), 19:1–19:23 (2011)Google Scholar
  6. 6.
    Lodderstedt, T., McGloin, M., Hunt, P.: Oauth 2.0 threat model and security considerations. Internet-Draft, IETF (October 2011)Google Scholar
  7. 7.
    Miculan, M., Urban, C.: Formal analysis of facebook connect single sign-on authentication protocol. In: Proc. SOFSEM (January 2011)Google Scholar
  8. 8.
    Pai, S., Sharma, Y., Kumar, S., Pai, R.M., Singh, S.: Formal verification of oauth 2.0 using alloy framework. In: Proc. CSNT (June 2011)Google Scholar
  9. 9.
    Pfitzmann, B., Waidner, M.: Analysis of liberty single-sign-on with enabled clients. IEEE Internet Computing 7(6), 38–44 (2003)CrossRefGoogle Scholar
  10. 10.
    Sun, S.-T., Beznosov, K.: The devil is in the (implementation) details: an empirical analysis of oauth sso systems. In: Proc. ACM CCS (October 2012)Google Scholar
  11. 11.
    Sun, S.-T., Boshmaf, Y., Hawkey, K., Beznosov, K.: A billion keys, but few locks: The crisis of web single sign-on. In: Proc. NSPW (September 2010)Google Scholar
  12. 12.
    Sun, S.-T., Hawkey, K., Beznosov, K.: Systematically breaking and fixing openid security: Formal analysis, semi-automated empirical evaluation, and practical countermeasures. Computers & Security 31(4), 465–483 (2012)CrossRefGoogle Scholar
  13. 13.
    Wang, R., Chen, S., Wang, X.: Signing me onto your accounts through facebook and google: a traffic-guided security study of commercially deployed single-sign-on web services. In: Proc. IEEE Symposium on S&P (May 2012)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  1. 1.Linköping UniversityLinköpingSweden
  2. 2.NICTASydneyAustralia

Personalised recommendations