1

For log in security, I know that you don’t want to identify whether or not it is specifically the username or password that is incorrect.

e.g. “The email or password you entered is incorrect”

Along those lines, is it ok to provide feedback that an email was previously used with SSO? For example, a user that initially signed in via Google SSO tries to log in via email on a subsequent visit. If we detect that email exists in the system and is connected via SSO, is it ok to inform the user without posing a security risk?

e.g. “This account is connected with Google SSO, please log in with Google”

Improve this question
2
  • Are there SSO accounts that aren't affiliated with a domain? It's much less of a risk to expose that *@company.com addresses all use SSO, but that falls apart if there's random e.g. @gmail.com addresses that use SSO.
    – lights0123
    Jun 30, 2021 at 17:20
  • It is most likely a combination of both types.
    – Rohrski
    Jun 30, 2021 at 19:43

2 Answers 2

Reset to default
1

Keep details about email accounts as private as possible. You could give every incorrect local login a generic message like "The email or password is incorrect". You could also add, based strictly on the email's domain and regardless of the existence of the account, something like: "Did you mean to login with Google?"

Airbnb has a nice pattern that remembers that you once logged in with SSO, and offers to let you login again with that account:

Airbnb login screen

Improve this answer
0

If you say "This account is connected with Google SSO, please log in with Google" this mean that you say "The user with this email has account in our system". It seemed not to be good because unathorized person obtain some kind of private information.

What if you expand your initial standard message for every situation in the following way:

"The email or password you entered is incorrect or maybe SSO used"

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.