3 ms·
I'm not familiar enough with SSO flows to be able to quantify any kind of risk, but it makes me very uneasy when things interconnect with my bank. Everything a
by curryst 6y ago
I'm not familiar enough with SSO flows to be able to quantify any kind of risk, but it makes me very uneasy when things interconnect with my bank. Everything always seems secure until it isn't.
I don't mean to spread FUD, it just seems needlessly risky to make banks the central point of auth.
- virgilp 6y agoIt really isn't/ shouldn't be. In theory, the bank is really incentivized to provide proper and secure authentication (if someone can impersonate you to your bank, you're kinda screwed anyway). So, it only makes sense to trust a bank to provide the authentication service. One should realize that SSO integration with a bank doesn't mean 3rd party has any sort of access to the bank - it' just means that you authorize your bank to tell a 3rd party "yes, I believe this is really curryst"). Doesn't increase the attack surface for you - it only increases the "blast radius" if someone successfully compromises your bank account. But that one is typically already a dire situation.
- vetinari 6y agoIt does increase the risk for you, the same way using Google or Facebook account does. Once the bank won't authenticate you for some reason, all the accounts bound to this SSO provider also go the way of dodo.