Evaluating and Enhancing SSO-Monitor: A Ground-Truth-Based Analysis of Single Sign-On Detection at Scale.

The use of Single Sign-On has increased significantly over the last decade, especially among popular web services. Single Sign-On allows users to access different services using accounts managed by Identity Providers such as Google, Apple, and Facebook. Its widespread adoption has made it an important topic in web security, but studying its deployment at scale requires automated tools that can discover authentication interfaces and identify the Identity Providers offered by websites. SSO-Monitor was developed for this purpose. The framework combines multiple login-page discovery and SSO-detection techniques in a modular system designed to support large-scale and repeatable measurements of Single Sign-On on the Web. This motivated the work in this thesis. Rather than building a new system, the goal was to evaluate how well the maintained SSO-Monitor artifact works in practice, identify the main causes of missed detections, and investigate how its reliability, efficiency, and SSO coverage could be improved. The publicly available artifact was first reproduced and evaluated before any repairs or extensions were introduced using a manually verified ground-truth dataset containing the top 200 Tranco domains, the initial reproduction detected only 5 of the 58 SSO-positive domains, achieving 8.62% recall, 100% precision, 73.50% accuracy, and 15.87% F1. After repairing implementation, dependency, configuration, and execution issues, the baseline improved to 68.97% recall, 86.96% precision, 88.00% accuracy, and 76.92% F1. This showed that the condition of the maintained artifact and its execution environment had a substantial effect on the observed performance. Further analysis showed that two important limitations remained: expensive login-page discovery and authentication interfaces in which Identity Providers were revealed only after additional interaction. To address these problems, the system was extended with staged login-page discovery and AuthGraph. AuthGraph is a bounded authentication-state exploration approach that represents authentication flows using states, actions, and transitions, allowing the system to explore multi-step authentication interfaces and collect evidence about Identity Provider transitions. In a controlled comparison using the same authentication pages and shared provider vocabulary, AuthGraph increased domain-level recall from 50.91% to 78.18% and provider-level recall from 39.20% to 69.60%. The final fused system achieved 79.31% recall, 90.20% precision, 91.50% accuracy, and 84.40% F1 on the main 200-domain benchmark, with an exact provider-set accuracy of 87.50%. Across the complete development process, False Negatives decreased from 53 to 12. The final system was additionally evaluated on Tranco ranks 201–300. Among the 70 usable and verifiable executions, it achieved 100% precision, 69.23% recall, 88.57% accuracy, and 81.82% F1. These results show that the system remained highly precise on a separate validation benchmark, while missed SSO-positive domains remained the main source of error. Overall, the results show that reliable large-scale SSO measurement depends on more than provider recognition alone. It also requires reproducible infrastructure, effective authentication-surface discovery, stateful interaction, sufficiently broad provider coverage, and careful handling of dynamic and blocked authentication behavior.