{
  "id": 6453879,
  "title": "SSO Without Giving the Server Your Keys",
  "url": "https://urgent.news/2026/09/09/sso-without-giving-the-server-your-keys",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-09T18:26:21.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/kornel_maraz_5e66a3e4e27d/sso-without-giving-the-server-your-keys-lm0"
  },
  "original_language": "en",
  "account": "Single sign-on (SSO) is a common solution for authentication, but it poses challenges when dealing with applications that encrypt data at the browser level. MindMapVault, a platform offering end-to-end encryption, faced this issue. To overcome this, they employed a unique approach that eliminates the need for users to manually enter passphrases.\n\nThe concept centers around deriving an encryption key from a user's passphrase within the browser. This master key, generated using Argon2id, is then utilized to encrypt and unlock various keys and vaults. The server only stores the ciphertext and a hash of the authentication token, never having access to the master key or any user's private keys.\n\nWhen integrating an identity provider, users authenticate through the provider and receive an OIDC token, which only confirms their identity and not the decryption key. The server cannot access the user's actual data without the master key.\n\nThe user experience involves two sign-ins: the first through the identity provider and subsequent sign-ins through the MindMapVault. A single passphrase is required initially when signing in, after which the user's machine is remembered for subsequent logins. If a new laptop is used, the user only needs to enter the passphrase once. Thus, the passphrase is entered as often as one purchases a new computer.\n\nThe authentication flow is straightforward, starting with the OIDC flow, followed by a redirect back to the server, where the user is redirected to the vault after successful verification. The ID token is then verified for signature, issuer, audience, expiry, and nonce. Upon successful verification, the server unlocks the vault locally, using a key that the server has never seen.\n\nThe integration of passkeys (cryptographic keys stored on devices) enhances the security and user experience, with the wrapping key generated in the browser and never exposed. The server only stores encrypted copies of the master key, each associated with a specific unlock method. The database is designed to store unlock methods, including the kind, label, wrapped master key, creation, and last usage timestamps.\n\nIn summary, the key takeaway from this SSO implementation is that the master key, derived from the user's passphrase, is never exposed to the server, ensuring end-to-end encryption and maintaining zero-knowledge trust. By adding passkeys as an unlock method, the system becomes even more secure and user-friendly.",
  "summary": "Single sign-on is a solved problem. You redirect to an identity provider, it tells you who the person is, you mint a session. Every framework has a library for it. Then you try it on an app that encrypts everything in the browser, and the whole thing falls over. The claim that breaks SSO MindMapVault derives your encryption key from your passphrase, in your browser, and never sends it anywhere:…",
  "key_points": [
    "Master key derived from passphrase, never exposed to server",
    "OIDC token confirms identity, not decryption key",
    "Passkeys enhance security, user experience"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}