4 ms·
Would a password manager solve that problem?
by randomsearch 6y ago
Would a password manager solve that problem?
- hellcow 6y agoIf you can enforce that they use the password manager, it solves that one problem. But SSO centralizes access management. For instance, with one switch I can set password requirements, require 2FA, and grant/revoke access to all of an employee's services when they join the company or leave.
- petre 6y agoI'm sure there are ways to use 2FA or OTP without externalising access management to Facebook, Google or another SSO provoder, unless you want to pick convenience over privacy and security.
- cratermoon 6y agoThere are, but writing your own authn/authz is about as wise as writing your own cipher. https://www.schneier.com/crypto-gram/archives/1998/1015.html#cipherdesign https://www.schneier.com/crypto-gram/archives/1998/1015.html...
- petre 6y agoI'm talking about using a library like privacyID3A or something else, not writing your own.
- lordlimecat 6y agoHow do you centralized your authn, your 2fa provisioning? How do you ensure that your cloud native apps have access to the auth backend without risking exposing the wrong ports on the wrong vpc?
- cratermoon 6y agoJust adding a library to application code is not sufficient. What I mean is that organizations should not roll their own SSO provider. At the very least, work with one of the many companies that offer it as a product or service. If your threat model requires it, you can host the product on premises.
- SilverRed 6y agoHow do you enforce it over a bunch of 3rd party software which either doesn't support 2FA or doesn't support enforcing it? If they support SSO which they usually do, its a non issue.
- folbec 6y agoNot really, at scale. SSO is a must in any big organisation, there are tens or hundred of applications. People are incredibly and consistently bad with security. You really need a way to be able to cancel all accesses in one swoop for any individual.
- foepys 6y agoNot only that. As a user it's incredibly frustrating entering a password 5 or more times each morning. This results in users using extremely weak passwords. The same is true for forcing users to reset their password every 50 days or so, by the way. This outdated password guideline doesn't seem to die. I know way to many cases where people are using a weak base password with a number attached to it because they got sick of trying to remember a new password every month.
- baq 6y ago> The same is true for forcing users to reset their password every 50 days or so, by the way. This outdated password guideline doesn't seem to die. I know way to many cases where people are using a weak base password with a number attached to it because they got sick of trying to remember a new password every month. there are people who actually invent a new password every time instead of cycling numbers? also, change password a few times until history is flushed and switch back to the same password you started with is a thing.
- folbec 6y agoWell, sadly this rule about password aging made its way into some regulations. We know it is idiotic, but it is the law.
- adrr 6y agoSSO is more than password management. It is instant provisioning and deprovisioning of users. Role management and auditing. Enforcement of security standards like 2FA in a central place.
- yladiz 6y agoNot really relevant for the specific topic, but to be more precise, SSO is only the sign on part. Usually the provisioning/de-provisioning is handled by SCIM, which is related but distinct. You have some SaaS products that offer SSO but not SCIM, for example.
- adrr 6y agoCurious what IDP service doesn't provide SCIM and just SSO. Doesn't SAML 2.0 have SCIM support?
- yladiz 6y agoSorry, I should have been more clear. When I typed SaaS products I meant more about a non-IDP product. They might support SSO but not SCIM-based account provisioning, especially if it's in-house auth (not using something like Auth0). I worked on a product that supported SSO but not SCIM for a long time and not all SCIM features were supported.
- samstave 6y agoWho is the best SSO provider? Where can I learn about best SSO practice/implementation?
- koheripbal 6y agoNo because you want to be able to offboard/disable those accounts without having to manually do it for each one.