OAuthGuard：使用OAuth 2.0和OpenID Connect保护用户安全和隐私
OAuthGuard: Protecting User Security and Privacy with OAuth 2.0 and OpenID Connect
摘要：
数百万用户经常使用Google登录支持OAuth 2.0或OpenID Connect的网站;因此，OAuth 2.0和OpenID Connect的安全性至关重要。正如之前的研究所揭示的那样，在实践中，RP经常错误地实现OAuth 2.0，因此许多现实世界的OAuth 2.0和OpenID Connect系统都容易受到攻击。然而，这种有缺陷的系统的用户通常不知道这些问题，因此面临着可能导致在RP处对受害者用户的帐户进行未经授权访问的攻击的风险。为了应对这一威胁，我们开发了OAuthGuard，这是一款OAuth 2.0和OpenID Connect漏洞扫描器和保护器，可与使用Google OAuth 2.0和OpenID Connect服务的RP一起使用。它可以保护用户的安全和隐私，即使RP没有正确实现OAuth 2.0或OpenID Connect。我们使用OAuthGuard调查了1000个支持Google登录的排名靠前的网站，以寻找可能存在的五个OAuth 2.0或OpenID Connect安全和隐私漏洞，其中一个以前没有在文献中描述过。在我们研究的137个使用Google Sign-in的网站中，有69个网站至少存在一个严重漏洞。OAuthGuard能够保护这69个RP中的56个的用户安全和隐私，并且能够警告其他13个用户他们正在使用不安全的实现。
英文摘要：
Millions of users routinely use Google to log in to websites supporting OAuth 2.0 or OpenID Connect; the security of OAuth 2.0 and OpenID Connect is therefore of critical importance. As revealed in previous studies, in practice RPs often implement OAuth 2.0 incorrectly, and so many real-world OAuth 2.0 and OpenID Connect systems are vulnerable to attack. However, users of such flawed systems are typically unaware of these issues, and so are at risk of attacks which could result in unauthorised access to the victim user's account at an RP. In order to address this threat, we have developed OAuthGuard, an OAuth 2.0 and OpenID Connect vulnerability scanner and protector, that works with RPs using Google OAuth 2.0 and OpenID Connect services. It protects user security and privacy even when RPs do not implement OAuth 2.0 or OpenID Connect correctly. We used OAuthGuard to survey the 1000 top-ranked websites supporting Google sign-in for the possible presence of five OAuth 2.0 or OpenID Connect security and privacy vulnerabilities, of which one has not previously been described in the literature. Of the 137 sites in our study that employ Google Sign-in, 69 were found to suffer from at least one serious vulnerability. OAuthGuard was able to protect user security and privacy for 56 of these 69 RPs, and for the other 13 was able to warn users that they were using an insecure implementation.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
