> the attacker can just setup their own fake sudo program to grab the user password. I've thought about that vulnerability a lot using enterprise SSO apps: it

> the attacker can just setup their own fake sudo program to grab the user password. I've thought about that vulnerability a lot using enterprise SSO apps: it would be trivial for anybody inside a corporate firewall to set up, say, a ticketing app that presented an SSO sign-in box, recorded whatever was input, but responded to everything as success. An attacker could harvest a LOT of passwords that way before being caught.