this post was submitted on 14 Jan 2025
13 points (93.3% liked)
Hacker News
1768 readers
352 users here now
Posts from the RSS Feed of HackerNews.
The feed sometimes contains ads and posts that have been removed by the mod team at HN.
founded 9 months ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I still can't comprehend how Google used just the mail address or domain for their SSO
I would have expected something like a hash over mail address and password + salt or something, so a new registrar would have a different hash
Just using the date of registration in the hash would have been mitigating this stuff - or do I miss something?
Usually the flaw us on the service provider side when using only email address for SSO. Typically the idp will provide a sub claim which is unique to the account and independent of email.
I see the article mentions this sub as having as an unreliable claim value. I can't dispute that experience, but have not observed it personally. Though my experience is on a much smaller system.