  The number of login options on web sites has increased since the introduction
of web single sign-on (SSO) protocols. Web SSO services allow users to grant
web sites or relying parties (RPs) access to their personal profile information
from identity provider (IdP) accounts. Many RP sites do not provide sufficient
privacy information that could help users make informed login decisions.
Moreover, privacy differences in permission requests across login options are
largely hidden from users and are time-consuming to manually extract and
compare. In this paper, we present an empirical analysis of popular RP
implementations supporting three major IdP login options (Facebook, Google, and
Apple) and categorize RPs in the top 500 sites into four client-side code
patterns. Informed by these RP patterns, we design and implement SSOPrivateEye
(SPEye), a browser extension prototype that extracts and displays to users
permission request information from SSO login options in RPs covering the three
IdPs.
