Wednesday, March 27, 2024

mydisneyaccount.com How NOT to do SSO.

tl;dr make sure your password manager has all the right urls... a Google sheet to aid in keeping your info up to date. https://docs.google.com/spreadsheets/d/1e1LFqRDEoFg0q9RMvN-63-28twthGTYa3m08j1Z94bI/edit?usp=sharing


 Disney a while back started to unify all your accounts to one login. The trouble is, they don't appear to use industry standards of the SSO actually using said URL to login. Instead it's the same username and password on several different URLs.... 


One of the reasons this is a concern is password managers. I've been saved from phishing sites before because my password manager didn't recognize the URL of my bank. (yes I should be using a favorite) I searched my bank one day, and the first result was a really well done phishing site, luckily I didn't log in thanks to my password manager not recognizing the login. 


Their site list a bunch of places the account is used, but this once again doesn't function like a proper oauth where it links to said applications. 



So I hopefully found all the right sites. in the spreadsheet, also including them here for search algos.

NameURL
My Disney Accounthttps://mydisneyaccount.com
Huluhttps://hulu.com
ESPN+https://plus.espn.com/
ABChttps://abc.com/
ABC Newshttps://abcnews.go.com/
National Geographichttps://www.nationalgeographic.com/
NatGeo TVhttps://www.nationalgeographic.com/tv
Freeformhttps://www.freeform.com/
FX Nowhttps://fxnow.fxnetworks.com/
Walt Disney Worldhttps://disneyworld.disney.go.com/
Disneyland Resorthttps://disneyland.disney.go.com/
Tokyo Disney Resorthttps://www.tokyodisneyresort.jp/top.html
Disney Vacation Clubhttps://disneyvacationclub.disney.go.com/
Aulanihttps://www.disneyaulani.com/
Disney Cruise Linehttps://disneycruise.disney.go.com/
Play Disney Parkshttps://disneyworld.disney.go.com/guest-services/play-app/
Golden Oakhttps://www.disneygoldenoak.com/
Club 33https://www.club33.com/
D23https://d23.com/
Disney Storehttps://www.disneystore.com/
Disney Rewardshttps://disneyrewards.com/manage-account/#/welcome
Disney Gift Cardhttps://www.disneygiftcard.com/
ESPNhttps://espn.com
ESPN Fantasyhttps://www.espn.com/fantasy/
ESPN - Foot Tipshttps://www.footytips.com.au/
Marvelhttps://www.marvel.com/
Marvel Unlimitedhttps://www.marvel.com/unlimited
Star Warshttps://www.starwars.com/
Disney Movie Insidershttps://www.disneymovieinsiders.com/
Disney On Icehttps://www.disneyonice.com/
Run Disneyhttps://www.rundisney.com/
Disney Institutehttps://www.disneyinstitute.com/
Disney Weddingshttps://www.disneyweddings.com/
ABC7 Los Angeleshttps://abc7.com/los-angeles/
ABC7 New Yorkhttps://abc7ny.com/
ABC7 Chicagohttps://abc7chicago.com/
6abc Philadelphiahttps://6abc.com/philadelphia/
ABC7 Bay Areahttps://abc7news.com/tag/bay-area/
ABC13 Houstonhttps://abc13.com/
ABC11 North Carolinahttps://abc11.com/about/newsteam/
ABC30 Central Californiahttps://abc30.com/


An example of what my Bitwarden entry now looks like.