Single sign-on is only as secure as the authentication behind it. SSO reduces how many passwords exist and how many places they are stored, but it also puts access to many apps behind one login, so a stolen password can open all of them. The fix isn't abandoning SSO. It's pairing it with strong authentication, ideally one that doesn't depend on a password at all.

The Promise of Single Sign-On

Single sign-on could be the closest thing we have to an authoritative, universal passport, for your local device and for the internet in general. But authentication that keeps intruders out while also proving who the user really is remains the area where most SSO solutions fall short.

Our computers and smartphones make everything easier except the increasingly complex security realm. Logging in once sounds like a no-brainer. Why prove yourself to your computer or phone more than once after you unlock it, open the browser, and start working? It's logical to presume it's you using the device, since you managed to open it in the first place. That's how authentication and single sign-on should work.

It's also how we all wanted passwords to work, but they don't. SSO is a step toward cleaning up our password-saturated lives. The gains in convenience and usability are here, but the glaring weak point remains: password-based credentials.

What SSO Does and Doesn't Fix

SSO works fine at every scale, from Facebook to internal private software systems, but it never addresses how you authenticate yourself. It improves speed and simplicity, and it opens some questionable security doors while closing others.

Is Single Sign-On Just a Single Point of Failure?

Yes and no. Single sign-on without the right authentication won't solve any security problems. A compromised password is bad enough, but a compromised password linked to an SSO solution is much worse.

There's an endless supply of apps, services, and e-commerce sites that require a username and password, and most of them only let users set and reuse weak passwords. In that scenario, SSO reduces the total number of passwords out there, because the services you sign in to no longer need to store or securely hash your password. They confirm you through the identity provider instead.

Storing credentials in many places, hashed or not, raises the odds that someone steals at least one set. Services that rely on an identity provider keep one more set of credentials out of one more data center somewhere in the cloud. It's a numbers game, and SSO puts your eggs in one basket.

That creates the nightmare scenario where password fatigue and misuse expose multiple accounts. It isn't hard for an intruder to find other accounts and services reachable through the same SSO.

It's Not the Single Sign-On. It's How You Sign On

Signing on once is not an insecure process. What matters is how you sign on in the first place. A secure SSO deployment should at least be supplemented with an MFA method. The upside of putting your eggs in one basket is that you can build a shield around it.

Not every MFA method shields equally, though. CISA's guidance on phishing-resistant MFA explains why codes and push approvals can still be phished. For how the pieces fit together, see 2FA vs MFA vs Strong Authentication.

Imagine Single Sign-On Without a Password

Few people talk about authenticating the actual user at login, which is still hard to pull off with a password alone. If you aren't proving you're you, SSO is merely presuming it's you, and it misses the authentication problem it could easily solve.

How the first set of credentials is protected can make or break any attempt at secure single sign-on. One small step keeps getting in the way of convenient, secure sign-in, and it's the password again. Password saturation wastes the owner's time while leaving openings for a break-in. The answer seems to be relying on passwords even less than we do now.

If MFA methods can stand in the way of a stolen password being used, can't one of them stand in the way of the password being stolen in the first place?

Pairing Authentication With SSO

Pairing a robust authentication service with an SSO solution can significantly improve security for everyone involved. With WWPass SSO, users sign in with a WWPass Key instead of a username and password, so the login that unlocks your apps has no password to steal. For implementation patterns, see Passwordless SSO for Web & Mobile Apps and SSO Without Usernames. If your users sign in to SSO from phones, read Mobile SSO Risks & How WWPass Protects Enterprise Applications as well.

NIST's Digital Identity Guidelines cover federation, the standards behind how an identity provider vouches for you to other services, if you want the technical background.

FAQ

Is single sign-on secure?
SSO is only as secure as the authentication used to reach it. It can reduce password sprawl, but if one weak or stolen password unlocks the SSO login, it unlocks everything connected to it.

Is SSO a single point of failure?
Yes and no. SSO concentrates access behind one login, which raises the stakes if that login is compromised. It also means you can build strong protection around that single point, with MFA or passwordless authentication.

Does SSO mean services no longer store my password?
Services that rely on an identity provider don't need to store or hash your password, because the identity provider confirms who you are. The identity provider still holds your credentials, so protecting that login matters even more.

What authentication should be paired with SSO?
At minimum, MFA. Stronger still is authentication that doesn't use a password at all, such as a key or device you carry, so a stolen password can't open the connected apps.

What does passwordless SSO mean?
A single sign-on login that verifies you with something you have, instead of a typed password, so there's no password to steal or reuse across the apps behind it.

The Bottom Line

Single sign-on is a good idea built on a weak foundation if it still starts with a password. Replace that step with authentication that proves the user is really the user, and SSO delivers on its promise: one convenient login that is also hard to break.

Want to see how it works? Explore WWPass SSO.