3 ms·

My experience with SSO workflows is that they often ask for reauthentication due to limited credential timeouts. They pop up randomly as you visit sites you're

My experience with SSO workflows is that they often ask for reauthentication due to limited credential timeouts. They pop up randomly as you visit sites you're used to visit. On the other hand site-specific logins tend to last longer which means I'm unlikely to encounter a login prompt as part of regular browsing. To given an example, github only prompts me for my personal credentials when I use the security settings or to authorize a bot. This doesn't happen often, so it's somewhat surprising and makes me check. But my $WORK SSO tied to their github org (and a whole bunch of other things) wants me to log in every other day. This makes more less likely to check since it's forced routine.

Thorrez 5y ago
>But my $WORK SSO tied to their github org (and a whole bunch of other things) wants me to log in every other day. I don't think consumer SSO does that. I think Facebook and Google generally try to avoid logging users out randomly because it causes user annoyance as well as user loss (because a lot of users might not remember their passwords or bother logging back in again). Your work SSO can tolerate a bad user experience in order to have higher security. You're being paid to log in every day. Facebook and Google users aren't being paid to log in every day, so many of them won't.