This is a completely unacceptable vulnerability in any software purporting itself to be an identity provider. OP, name and shame this provider. I do not want to find myself using it.
Question: How does a subdomain get discovered by a member of the public if there are no references to it anywhere online?
The only thing I can think of that would let you do that would be a DNS zone transfer request, but those are almost always disallowed from most origin IPs.
Honest question, why is this your reaction? Why are people on this forum so unwilling to be happy for others? I have noticed that this attitude is extremely prominent in tech. Everything is either perfect (according to the person making the judgement) or it’s utterly worthy of ridicule. I am growing very, very tired of seeing this throughout tech.
Well, maybe he shouldn’t but it seems he’d rather not deal with this problem at all and now we have the status quo. That has to be a situation you’re willing to accept, unless you’re saying Facebook should be forced to allow news, and be forced to pay for it.