4 ms·

I mean, I was going to point out that that sentence massively compromises the validity of the author's argument, because I've been in companies with more than f

by baddox 7y ago

I mean, I was going to point out that that sentence massively compromises the validity of the author's argument, because I've been in companies with more than five employees for which this was definitely not a core security requirement. It's one thing to say that some feature is actually adopted as a security requirement at many companies and that SaaS vendors who don't offer that feature will lose out on those companies as customers. It's another thing to say that SaaS vendors are failing to meet a massive market requirement, and that companies on the other side of that market are also failing to "realize" and adopt that requirement. In other words, unless I saw evidence that a larger portion of 6-person companies demanded this feature, it seems reasonable to assume that the market simply doesn't want this feature, and SaaS vendors aren't doing anything particularly stupid by not offering the feature.

femiagbabiaka 7y ago
> I mean, I was going to point out that that sentence massively compromises the validity of the author's argument, because I've been in companies with more than five employees for which this was definitely not a core security requirement. no, it was a core security requirement whether or not it was accepted as such. but it turns out that saving money wins out over security until you get owned OR you're making enough money to not care.
- baddox 7y ago
  I think that's a dangerous game with words. The argument boils down to claiming that customers absolutely need a feature but aren't aware of it, and SaaS vendors absolutely need to offer that feature but aren't aware of it.
  - femiagbabiaka 7y ago
    this is the state of corporate security! remember, until about 5-6 years ago 2fa and HTTPS were another couple of examples of things people thought were unnecessary.
- Spivak 7y ago
  I think the strongest evidence that SSO isn’t a core security requirement is the fact that people aren’t demanding that every site support “login with $social.” SSO is net good for security and is a quick way around a lot of red tape in certain regulatory domains but the value prop has always been, and still is, largely administrative. Having a human manage the accounts of hundreds of people with 10+ logins each services each costs real money compared to adding an account once to AD and dropping them in the group with the rest of their team which is why companies, rightly, feel they can charge a pretty penny for the privilege. Small companies can afford rolling accounts by hand but then you grow and then you have to decide if it’s worth spending the employee hours or the cash.
  - danaris 7y ago
    > I think the strongest evidence that SSO isn’t a core security requirement is the fact that people aren’t demanding that every site support “login with $social.” The very last thing I want from my bank, insurance company, or what have you is for them to be handing over information about every login I make to Google or Facebook.

by baddox 7y ago

femiagbabiaka 7y ago

> I mean, I was going to point out that that sentence massively compromises the validity of the author's argument, because I've been in companies with more than five employees for which this was definitely not a core security requirement. no, it was a core security requirement whether or not it was accepted as such. but it turns out that saving money wins out over security until you get owned OR you're making enough money to not care.

baddox 7y ago
I think that's a dangerous game with words. The argument boils down to claiming that customers absolutely need a feature but aren't aware of it, and SaaS vendors absolutely need to offer that feature but aren't aware of it.
- femiagbabiaka 7y ago
  this is the state of corporate security! remember, until about 5-6 years ago 2fa and HTTPS were another couple of examples of things people thought were unnecessary.
Spivak 7y ago
I think the strongest evidence that SSO isn’t a core security requirement is the fact that people aren’t demanding that every site support “login with $social.” SSO is net good for security and is a quick way around a lot of red tape in certain regulatory domains but the value prop has always been, and still is, largely administrative. Having a human manage the accounts of hundreds of people with 10+ logins each services each costs real money compared to adding an account once to AD and dropping them in the group with the rest of their team which is why companies, rightly, feel they can charge a pretty penny for the privilege. Small companies can afford rolling accounts by hand but then you grow and then you have to decide if it’s worth spending the employee hours or the cash.
- danaris 7y ago
  > I think the strongest evidence that SSO isn’t a core security requirement is the fact that people aren’t demanding that every site support “login with $social.” The very last thing I want from my bank, insurance company, or what have you is for them to be handing over information about every login I make to Google or Facebook.