4 ms·

If you're not using SSO/central identity providers and use each site's own login form instead you're much less likely to encounter an unexpected login form whic

If you're not using SSO/central identity providers and use each site's own login form instead you're much less likely to encounter an unexpected login form which makes any such form suspicious.

Thorrez 5y ago
The classic phishing is an email from e.g. Facebook saying your account is at risk of something. So you click the Facebook link and sign in to Facebook (uh oh that was actually a phishing site pretending to be Facebook). I don't see how avoiding SSO helps with this.
- the8472 5y ago
  Email is a separate topic. I have a domain and use a separate address for each service. So phishing tends to go to the wrong address and thus the wrong folder, which makes things pretty obvious.
  - Thorrez 5y ago
    My point is I don't see how whether you use SSO or not is relevant. If you use SSO, you could fall for an SSO phishing page. If you don't use SSO you could fall for a non-SSO phishing page. If your email is hidden, then someone might send you a phishing link via a HN reply. The reply might link to a website that has a domain similar to Facebook and presents a Facebook phishing login.
    - the8472 5y ago
      My experience with SSO workflows is that they often ask for reauthentication due to limited credential timeouts. They pop up randomly as you visit sites you're used to visit. On the other hand site-specific logins tend to last longer which means I'm unlikely to encounter a login prompt as part of regular browsing. To given an example, github only prompts me for my personal credentials when I use the security settings or to authorize a bot. This doesn't happen often, so it's somewhat surprising and makes me check. But my $WORK SSO tied to their github org (and a whole bunch of other things) wants me to log in every other day. This makes more less likely to check since it's forced routine.
      - Thorrez 5y ago
        >But my $WORK SSO tied to their github org (and a whole bunch of other things) wants me to log in every other day. I don't think consumer SSO does that. I think Facebook and Google generally try to avoid logging users out randomly because it causes user annoyance as well as user loss (because a lot of users might not remember their passwords or bother logging back in again). Your work SSO can tolerate a bad user experience in order to have higher security. You're being paid to log in every day. Facebook and Google users aren't being paid to log in every day, so many of them won't.

If you're not using SSO/central identity providers and use each site's own login form instead you're much less likely to encounter an unexpected login form which makes any such form suspicious.

Thorrez 5y ago

The classic phishing is an email from e.g. Facebook saying your account is at risk of something. So you click the Facebook link and sign in to Facebook (uh oh that was actually a phishing site pretending to be Facebook). I don't see how avoiding SSO helps with this.

the8472 5y ago
Email is a separate topic. I have a domain and use a separate address for each service. So phishing tends to go to the wrong address and thus the wrong folder, which makes things pretty obvious.
- Thorrez 5y ago
  My point is I don't see how whether you use SSO or not is relevant. If you use SSO, you could fall for an SSO phishing page. If you don't use SSO you could fall for a non-SSO phishing page. If your email is hidden, then someone might send you a phishing link via a HN reply. The reply might link to a website that has a domain similar to Facebook and presents a Facebook phishing login.
  - the8472 5y ago
    My experience with SSO workflows is that they often ask for reauthentication due to limited credential timeouts. They pop up randomly as you visit sites you're used to visit. On the other hand site-specific logins tend to last longer which means I'm unlikely to encounter a login prompt as part of regular browsing. To given an example, github only prompts me for my personal credentials when I use the security settings or to authorize a bot. This doesn't happen often, so it's somewhat surprising and makes me check. But my $WORK SSO tied to their github org (and a whole bunch of other things) wants me to log in every other day. This makes more less likely to check since it's forced routine.
    - Thorrez 5y ago
      >But my $WORK SSO tied to their github org (and a whole bunch of other things) wants me to log in every other day. I don't think consumer SSO does that. I think Facebook and Google generally try to avoid logging users out randomly because it causes user annoyance as well as user loss (because a lot of users might not remember their passwords or bother logging back in again). Your work SSO can tolerate a bad user experience in order to have higher security. You're being paid to log in every day. Facebook and Google users aren't being paid to log in every day, so many of them won't.