Single Sign on Authentication Over Public Networks Can Lead to Identity Theft