4 ms·

But then you're storing passwords in more services, which creates more surface area for breaches. If you shop with Amazon, host your services with Amazon, watc

But then you're storing passwords in more services, which creates more surface area for breaches. If you shop with Amazon, host your services with Amazon, watch TV on Amazon...there's simply no way of getting around the fact that Amazon will only want to manage a password for you in one place. The issue is clearly over reliance on Amazon services.

Jwarder 9y ago
I don't follow your logic about the breach risk. If you're using unique passwords per service (and you really should) then I would expect any breach that involved passwords would have less of an effect. If there is a breach with a centralized single sign on service then every other dependent service is also affected.
- willow9886 9y ago
  There's a big difference between what people should do, and what people actually do. Research consistently shows that a large percentage of people reuse passwords across many sites. [1] http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf
  - dlgeek 9y ago
    Sure, but I'd bet that people who have cloud services accounts are much more likely to be better at password security than the general public, as a group.
raverbashing 9y ago
Create multiple accounts then Yeah, it's convenient to have only one, but it seems it's dangerous as well
jethro_tell 9y ago
Uh, Sure, if you have one account. The point being that if you're smart, you isolate every account. myaccount-aws@domain and myaccount-retail@domain and then turn off cloud services for retail account and turn on two factor auth for saas. That's on you. You can't get the benifit of separation if you have them do it for you. In the same way you get one company to own your domain and one to run your email. That way when your email provider decides you're a spammer or your account get's closed for uploading a bad app to the android store, you can go else where and swap your dns.

Jwarder 9y ago

I don't follow your logic about the breach risk. If you're using unique passwords per service (and you really should) then I would expect any breach that involved passwords would have less of an effect. If there is a breach with a centralized single sign on service then every other dependent service is also affected.

willow9886 9y ago
There's a big difference between what people should do, and what people actually do. Research consistently shows that a large percentage of people reuse passwords across many sites. [1] http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf
- dlgeek 9y ago
  Sure, but I'd bet that people who have cloud services accounts are much more likely to be better at password security than the general public, as a group.

raverbashing 9y ago

Create multiple accounts then Yeah, it's convenient to have only one, but it seems it's dangerous as well

jethro_tell 9y ago

Uh, Sure, if you have one account. The point being that if you're smart, you isolate every account. myaccount-aws@domain and myaccount-retail@domain and then turn off cloud services for retail account and turn on two factor auth for saas. That's on you. You can't get the benifit of separation if you have them do it for you. In the same way you get one company to own your domain and one to run your email. That way when your email provider decides you're a spammer or your account get's closed for uploading a bad app to the android store, you can go else where and swap your dns.