<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01567599</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-21T10:25:02+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?</title>
            <author role="aut">
              <persName>
                <forename type="first">Alessandro</forename>
                <surname>Armando</surname>
              </persName>
              <idno type="halauthorid">114011-0</idno>
              <affiliation ref="#struct-302889"/>
              <affiliation ref="#struct-494238"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Roberto</forename>
                <surname>Carbone</surname>
              </persName>
              <idno type="halauthorid">676212-0</idno>
              <affiliation ref="#struct-494238"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Luca</forename>
                <surname>Compagna</surname>
              </persName>
              <idno type="halauthorid">114014-0</idno>
              <affiliation ref="#struct-301537"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jorge</forename>
                <surname>Cuellar</surname>
              </persName>
              <idno type="halauthorid">114015-0</idno>
              <affiliation ref="#struct-300755"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Giancarlo</forename>
                <surname>Pellegrino</surname>
              </persName>
              <idno type="halauthorid">676216-0</idno>
              <affiliation ref="#struct-301537"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Alessandro</forename>
                <surname>Sorniotti</surname>
              </persName>
              <idno type="halauthorid">528131-0</idno>
              <affiliation ref="#struct-302429"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2017-07-24 10:40:19</date>
              <date type="whenModified">2026-02-07 05:13:55</date>
              <date type="whenReleased">2017-07-24 10:42:15</date>
              <date type="whenProduced">2011-06-07</date>
              <date type="whenEndEmbargoed">2014-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-01567599v1/document">
                <date notBefore="2014-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-01567599v1/file/978-3-642-21424-0_6_Chapter.pdf" id="file-1567599-1620214">
                <date notBefore="2014-01-01"/>
              </ref>
              <ref type="externalLink" target="https://hal.inria.fr/hal-01567599/file/978-3-642-21424-0_6_Chapter.pdf"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01567599</idno>
            <idno type="halUri">https://inria.hal.science/hal-01567599</idno>
            <idno type="halBibtex">armando:hal-01567599</idno>
            <idno type="halRefHtml">&lt;i&gt;26th International Information Security Conference (SEC)&lt;/i&gt;, Jun 2011, Lucerne, Switzerland. pp.68-79, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-642-21424-0_6"&gt;&amp;#x27E8;10.1007/978-3-642-21424-0_6&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">26th International Information Security Conference (SEC), Jun 2011, Lucerne, Switzerland. pp.68-79, &amp;#x27E8;10.1007/978-3-642-21424-0_6&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1567599-1620214"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-SEC" corresp="IFIP"> International Information Security Conference</idno>
            <idno type="stamp" n="IFIP-AICT-354" corresp="IFIP-AICT">Future Challenges in Security and Privacy for Academia and Industry</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 3: Authentication</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Alessandro</forename>
                    <surname>Armando</surname>
                  </persName>
                  <idno type="halauthorid">114011-0</idno>
                  <affiliation ref="#struct-302889"/>
                  <affiliation ref="#struct-494238"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Roberto</forename>
                    <surname>Carbone</surname>
                  </persName>
                  <idno type="halauthorid">676212-0</idno>
                  <affiliation ref="#struct-494238"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Luca</forename>
                    <surname>Compagna</surname>
                  </persName>
                  <idno type="halauthorid">114014-0</idno>
                  <affiliation ref="#struct-301537"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jorge</forename>
                    <surname>Cuellar</surname>
                  </persName>
                  <idno type="halauthorid">114015-0</idno>
                  <affiliation ref="#struct-300755"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Giancarlo</forename>
                    <surname>Pellegrino</surname>
                  </persName>
                  <idno type="halauthorid">676216-0</idno>
                  <affiliation ref="#struct-301537"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Alessandro</forename>
                    <surname>Sorniotti</surname>
                  </persName>
                  <idno type="halauthorid">528131-0</idno>
                  <affiliation ref="#struct-302429"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>26th International Information Security Conference (SEC)</title>
                  <date type="start">2011-06-07</date>
                  <date type="end">2011-06-09</date>
                  <settlement>Lucerne</settlement>
                  <country key="CH">Switzerland</country>
                </meeting>
                <editor>Jan Camenisch</editor>
                <editor>Simone Fischer-Hübner</editor>
                <editor>Yuko Murayama</editor>
                <editor>Armand Portmann</editor>
                <editor>Carlos Rieder</editor>
                <imprint>
                  <publisher>Springer</publisher>
                  <biblScope unit="serie">Future Challenges in Security and Privacy for Academia and                    Industry</biblScope>
                  <biblScope unit="volume">AICT-354</biblScope>
                  <biblScope unit="pp">68-79</biblScope>
                  <date type="datePub">2011</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-642-21424-0_6</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Browser-based Single Sign-On (SSO) is replacing conventional solutions based on multiple, domain-specific credentials by offering an improved user experience: clients log on to their company system once and are then able to access all services offered by the company’s partners. By focusing on the emerging SAML standard, in this paper we show that the prototypical browser-based SSO use case suffers from an authentication flaw that allows a malicious service provider to hijack a client authentication attempt and force the latter to access a resource without its consent or intention. This may have serious consequences, as evidenced by a Cross-Site Scripting attack that we have identified in the SAML-based SSO for Google Apps: the attack allowed a malicious web server to impersonate a user on any Google application. We also describe solutions that can be used to mitigate and even solve the problem.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-302889" status="VALID">
          <idno type="IdRef">032054262</idno>
          <idno type="ROR">https://ror.org/0107c5v14</idno>
          <idno type="Wikidata">032054262</idno>
          <orgName>Università degli studi di Genova = University of Genoa = Université de Gênes</orgName>
          <orgName type="acronym">UniGe</orgName>
          <desc>
            <address>
              <addrLine>Via Balbi, 5 - 16126 Genova</addrLine>
              <country key="IT"/>
            </address>
            <ref type="url">https://unige.it/it</ref>
          </desc>
        </org>
        <org type="department" xml:id="struct-494238" status="VALID">
          <orgName>Security &amp; Trust Research Unit [Trento]</orgName>
          <date type="start">2017-05-04</date>
          <desc>
            <address>
              <country key="IT"/>
            </address>
          </desc>
          <listRelation>
            <relation active="#struct-452129" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-301537" status="VALID">
          <orgName>SAP Research</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-300755" status="VALID">
          <orgName>Siemens AG [Munich]</orgName>
          <date type="start">2016-11-02</date>
          <desc>
            <address>
              <addrLine>Siemens AG (Headquarters)Wittelsbacherplatz 280333 MunichGermany</addrLine>
              <country key="DE"/>
            </address>
            <ref type="url">https://www.siemens.com/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-302429" status="VALID">
          <orgName>IBM Research [Zurich]</orgName>
          <date type="start">2017-01-11</date>
          <desc>
            <address>
              <country key="CH"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-452129" status="VALID">
          <idno type="ROR">https://ror.org/01j33xk10</idno>
          <orgName>Fondazione Bruno Kessler [Trento, Italy]</orgName>
          <orgName type="acronym">FBK</orgName>
          <desc>
            <address>
              <addrLine>via Santa Croce, 77 - 38122 Trento</addrLine>
              <country key="IT"/>
            </address>
            <ref type="url">https://www.fbk.eu/en/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>