Collected research

SpoofedMe — Intruding Accounts using Social Login Providers

SpoofedMe: Intruding Accounts using Social Login Providers

Or Peles and Roee Hay · IBM Security Systems · 3 December 2014

Examines social-login impersonation when providers issue unverified email attributes and relying applications use them to locate or link accounts. The paper compares LinkedIn, Amazon and MYDIGIPASS flows, separating provider authentication, ownership of an email address and authorization to attach an identity to an existing account.

Record

Document

SpoofedMe: Intruding Accounts using Social Login Providers

Researcher

Or Peles and Roee Hay

Published by

IBM Security Systems

Date

3 December 2014

Format

Slides

Topic

Other

In the archive

• Collected in the 2014 research round

Related sources

• Comments on Wang-Chen-Wang paper on OpenID Implementation Vulnerability

Tags

• oauth
• sso
• identity
• auth-bypass
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Or Peles and Roee Hay, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.