3 ms·

Why do you see this as a single sign-on issue? Seems to me the issue is over reliance on large SaaS providers. Same things happens all the time to Google users.

mintplant 9y ago
Because if you lose that single sign-on account, you lose everything attached to it as well.
- willow9886 9y ago
  Amazon offers many services, of course they are going to want users to have one set of credentials to access all those services. There are trade-offs to every security approach, but storing passwords at every web service is 100x worse.
  - Hnrobert42 9y ago
    I don't understand your concern. We all have numerous accounts all over the web. Having one or two more doesn't increase our attack surface 100x.
  - aquadrop 9y ago
    What have passwords anything to do with this?
MichaelGG 9y ago
Because you're unlikey to trigger a violation on your cloud SaaS account, but could easily run afoul of other policies like "Real Name" or "Bought a Pixel Phone and Sold It" or posting something "offensive", getting reported by other users, etc. If the account is just for a cloud SaaS, then there's likely to be very few policies to disable your account.
- willow9886 9y ago
  But then you're storing passwords in more services, which creates more surface area for breaches. If you shop with Amazon, host your services with Amazon, watch TV on Amazon...there's simply no way of getting around the fact that Amazon will only want to manage a password for you in one place. The issue is clearly over reliance on Amazon services.
  - Jwarder 9y ago
    I don't follow your logic about the breach risk. If you're using unique passwords per service (and you really should) then I would expect any breach that involved passwords would have less of an effect. If there is a breach with a centralized single sign on service then every other dependent service is also affected.
    - willow9886 9y ago
      There's a big difference between what people should do, and what people actually do. Research consistently shows that a large percentage of people reuse passwords across many sites. [1] http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf
      - dlgeek 9y ago
        Sure, but I'd bet that people who have cloud services accounts are much more likely to be better at password security than the general public, as a group.
  - raverbashing 9y ago
    Create multiple accounts then Yeah, it's convenient to have only one, but it seems it's dangerous as well
  - jethro_tell 9y ago
    Uh, Sure, if you have one account. The point being that if you're smart, you isolate every account. myaccount-aws@domain and myaccount-retail@domain and then turn off cloud services for retail account and turn on two factor auth for saas. That's on you. You can't get the benifit of separation if you have them do it for you. In the same way you get one company to own your domain and one to run your email. That way when your email provider decides you're a spammer or your account get's closed for uploading a bad app to the android store, you can go else where and swap your dns.

mintplant 9y ago

Because if you lose that single sign-on account, you lose everything attached to it as well.

willow9886 9y ago
Amazon offers many services, of course they are going to want users to have one set of credentials to access all those services. There are trade-offs to every security approach, but storing passwords at every web service is 100x worse.
- Hnrobert42 9y ago
  I don't understand your concern. We all have numerous accounts all over the web. Having one or two more doesn't increase our attack surface 100x.
- aquadrop 9y ago
  What have passwords anything to do with this?

MichaelGG 9y ago

Because you're unlikey to trigger a violation on your cloud SaaS account, but could easily run afoul of other policies like "Real Name" or "Bought a Pixel Phone and Sold It" or posting something "offensive", getting reported by other users, etc. If the account is just for a cloud SaaS, then there's likely to be very few policies to disable your account.

willow9886 9y ago
But then you're storing passwords in more services, which creates more surface area for breaches. If you shop with Amazon, host your services with Amazon, watch TV on Amazon...there's simply no way of getting around the fact that Amazon will only want to manage a password for you in one place. The issue is clearly over reliance on Amazon services.
- Jwarder 9y ago
  I don't follow your logic about the breach risk. If you're using unique passwords per service (and you really should) then I would expect any breach that involved passwords would have less of an effect. If there is a breach with a centralized single sign on service then every other dependent service is also affected.
  - willow9886 9y ago
    There's a big difference between what people should do, and what people actually do. Research consistently shows that a large percentage of people reuse passwords across many sites. [1] http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf
    - dlgeek 9y ago
      Sure, but I'd bet that people who have cloud services accounts are much more likely to be better at password security than the general public, as a group.
- raverbashing 9y ago
  Create multiple accounts then Yeah, it's convenient to have only one, but it seems it's dangerous as well
- jethro_tell 9y ago
  Uh, Sure, if you have one account. The point being that if you're smart, you isolate every account. myaccount-aws@domain and myaccount-retail@domain and then turn off cloud services for retail account and turn on two factor auth for saas. That's on you. You can't get the benifit of separation if you have them do it for you. In the same way you get one company to own your domain and one to run your email. That way when your email provider decides you're a spammer or your account get's closed for uploading a bad app to the android store, you can go else where and swap your dns.