Is Your SSO Protected Against Modern Credential Attacks?