4 ms·
If you can enforce that they use the password manager, it solves that one problem. But SSO centralizes access management. For instance, with one switch I can s
by hellcow 6y ago
If you can enforce that they use the password manager, it solves that one problem.
But SSO centralizes access management. For instance, with one switch I can set password requirements, require 2FA, and grant/revoke access to all of an employee's services when they join the company or leave.
- petre 6y agoI'm sure there are ways to use 2FA or OTP without externalising access management to Facebook, Google or another SSO provoder, unless you want to pick convenience over privacy and security.
- cratermoon 6y agoThere are, but writing your own authn/authz is about as wise as writing your own cipher. https://www.schneier.com/crypto-gram/archives/1998/1015.html#cipherdesign https://www.schneier.com/crypto-gram/archives/1998/1015.html...
- petre 6y agoI'm talking about using a library like privacyID3A or something else, not writing your own.
- lordlimecat 6y agoHow do you centralized your authn, your 2fa provisioning? How do you ensure that your cloud native apps have access to the auth backend without risking exposing the wrong ports on the wrong vpc?
- cratermoon 6y agoJust adding a library to application code is not sufficient. What I mean is that organizations should not roll their own SSO provider. At the very least, work with one of the many companies that offer it as a product or service. If your threat model requires it, you can host the product on premises.
- SilverRed 6y agoHow do you enforce it over a bunch of 3rd party software which either doesn't support 2FA or doesn't support enforcing it? If they support SSO which they usually do, its a non issue.