{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T17:04:38Z","timestamp":1783184678714,"version":"3.54.6"},"reference-count":55,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833753","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"1774-1790","source":"Crossref","is-referenced-by-count":20,"title":["Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments"],"prefix":"10.1109","author":[{"given":"Mohammad","family":"Ghasemisharif","sequence":"first","affiliation":[{"name":"University of Illinois at Chicago"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chris","family":"Kanich","sequence":"additional","affiliation":[{"name":"University of Illinois at Chicago"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jason","family":"Polakis","sequence":"additional","affiliation":[{"name":"University of Illinois at Chicago"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2010.114"},{"key":"ref12","article-title":"Session management cheat sheet","year":"2021"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29962-0_29"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.30"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00053"},{"key":"ref52","first-page":"223","article-title":"Not-quite-so-broken {TLS}: Lessons in re-engineering a security protocol specification and implementation","author":"kaloper-mer?injak","year":"2015","journal-title":"24th USENIX Security Symposium USENIX Security 15"},{"key":"ref11","article-title":"Using facebook login with existing login systems","year":"2021"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978363"},{"key":"ref10","article-title":"Access tokens - facebook login","year":"2021"},{"key":"ref54","first-page":"1323","article-title":"Measuring https adoption on the web","author":"felt","year":"2017","journal-title":"26th USENIX Security Symposium ( USENIX Security 17)"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417869"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/2994620.2994638"},{"key":"ref19","article-title":"Puppeteer","year":"2021"},{"key":"ref18","article-title":"Google Threat Analysis Group - Phishing campaign targets YouTube creators with cookie theft malware","author":"shen","year":"2021"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00015"},{"key":"ref50","article-title":"Protecting Web Single Sign-on against Relying Party Impersonation Attacks through a Bi-directional Secure Channel with Authentication","author":"cao","year":"2014","journal-title":"Proceedings of the 17th International Symposium on Research in Attacks Intrusions and Defense ser RAID"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CSF.2017.20"},{"key":"ref45","article-title":"Hybridauth social login php library","year":"2021"},{"key":"ref48","article-title":"Authscan: Automatic extraction of web authentication protocols from implementations","author":"bai","year":"2013","journal-title":"Proceedings of NDSS 2013"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897874"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23046"},{"key":"ref41","article-title":"Data deletion callback – app development","year":"2021"},{"key":"ref44","article-title":"You’ve got vulnerability: Exploring effective vulnerability notifications","author":"li","year":"2016","journal-title":"25th USENIX Security Symposium (USENIX Security 16)"},{"key":"ref43","article-title":"Hey, you have a problem: On the feasibility of large-scale web vulnerability notification","author":"stock","year":"2016","journal-title":"25th USENIX Security Symposium (USENIX Security 16)"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23286"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.49"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450085"},{"key":"ref9","article-title":"The New York Times - Facebook Hack Puts Thousands of Other Sites at Risk","author":"isaac","year":"2018"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382238"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-13257-0_34"},{"key":"ref6","first-page":"1475","article-title":"O single sign-off, where art thou? an empirical analysis of single sign-on account hijacking and session management on the web","author":"ghasemisharif","year":"2018","journal-title":"27th USENIX Security Symposium (USENIX Security 18)"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20550-2_13"},{"key":"ref40","article-title":"Login security – facebook login","year":"2021"},{"key":"ref35","article-title":"Gnu parallel 20200522 (’kraftwerk’)","author":"tange","year":"2020","journal-title":"GNU Parallel is a general parallelizer to run multiple serial command line programs in parallel without changing them"},{"key":"ref34","first-page":"595","article-title":"Meerkat: Detecting website defacements through image-based object recognition","author":"borgolte","year":"2015","journal-title":"24th USENIX Security Symposium USENIX Security 15"},{"key":"ref37","article-title":"Final: Openid connect core 1.0 incorporating errata set 1","author":"sakimura","year":"2021"},{"key":"ref36","article-title":"Re-authentication - facebook login","year":"2021"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3437524"},{"key":"ref30","article-title":"The majestic million","year":"2020"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2019.8802671"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3431171"},{"key":"ref2","first-page":"495","article-title":"Ssoscan: Automated testing of web applications for single sign-on vulnerabilities","author":"zhou","year":"2014","journal-title":"23rd USENIX Security Symposium (USENIX Security 14)"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.32"},{"key":"ref39","article-title":"Facebook login update – about facebook","year":"2021"},{"key":"ref38","article-title":"Openid connect","year":"2021"},{"key":"ref24","article-title":"uncaptcha: a low-resource defeat of recaptcha’s audio challenge","author":"bock","year":"2017","journal-title":"11th USENIX Workshop on Offensive Technologies (WOOT 17)"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140443"},{"key":"ref26","article-title":"It is not possible to detect and block chrome headless","author":"sangaline","year":"2021"},{"key":"ref25","article-title":"Build natural language experience","year":"2021"},{"key":"ref20","article-title":"Randexp","year":"2021"},{"key":"ref22","article-title":"Communication apis for sms, voice, video and authentication","year":"2021"},{"key":"ref21","article-title":"Gmail api","year":"2021"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450050"},{"key":"ref27","article-title":"puppeteer-extra-plugin-stealth","author":"berstend","year":"2021"},{"key":"ref29","article-title":"Accessibility overview","year":"2021"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833753.pdf?arnumber=9833753","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T23:11:25Z","timestamp":1699485085000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833753\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":55,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833753","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}