4 ms·

I usually very much agree with you. But this is a case where I'll "beg to differ". At least we agree on the baseline of not charging for 2FA. The fact is, it'

I usually very much agree with you. But this is a case where I'll "beg to differ". At least we agree on the baseline of not charging for 2FA. The fact is, it's very difficult to fight "shadow IT". SaaS companies penalizing early adopters for access to acceptable security only incentivizes employees, at large and small companies, to bypass IT vendor management and security policies. And once you've had to make an exception for "the CROs favorite SaaS tool", it's going to be fair game and an uphill battle to taken seriously. As an industry, as a society, we need to make some of these security features easier to implement, easier to adopt, and not a penalty. As I noted in a sibling comment, I also think that running a protection racket is lazy product management and marketing. Frankly, if you are telling me that I have to pay extra for protection, that tells me that you don't take security seriously, since you are basically operating an insecure environment as your default practice.

michaelt 5y ago
> As an industry, as a society, we need to make some of these security features easier to implement They're very easy to implement - it just costs money. If you've got enough employees that you need SSO, it's time to move off the free tier. As an industry, as a society, we need to stop expecting developers to deliver services to huge multinationals for $0
tptacek 5y ago
The companies listed on the sso.tax site include many that self-evidently take security extremely seriously, far more so than most of their customers, so I don't know where that leaves your argument. It sounds like you're just not happy that SSO gets used for market seg. I'm not "happy" about it either. That doesn't make it a dark pattern or an indicator that companies "don't take security seriously".
- numbsafari 5y ago
  The status quo is the problem here. So pointing to the status quo doesn't invalidate my argument. Taking security seriously means you take the security of your customers and your users seriously--not just yourself. I'm sure a lot of those companies take their own security seriously. That doesn't mean they shouldn't be doing a better job for their customers, their users, and the rest of society. It's not just that my feelings are hurt, it's that I personally view this as a societal issue. Our tremendous reliance on this internet thing, and our lax day-to-day security practices and expectations, puts us at serious risk--individually and as a society. You regularly post about the overcomplexity of security protocols and their poor implementation. I'm sure you're more than just "unhappy" about those things. SSO shouldn't be hard to implement relative to, say, MFA--especially since so many use SMS. Auditing should be incredibly straightforward to implement, especially if you are using tools like Rails or Django.
  - tptacek 5y ago
    Charging money for SAML integration is simply not a "societal issue".
    - numbsafari 5y ago
      Nor are either JWT or DNSSEC--on their own. But we aren't having a discussion amongst the general population. We're having a discussion amongst people who plan, design, and build these systems and who, as professionals and practitioners, society looks to for input on policy choices. The fact that SSO--and let's be honest, it'd be nice if it weren't always SAML, just like it'd be nice if Google/et.al. didn't force us all to use JWT--is so broadly taxed should be viewed the same way we used to view storing passwords in plain text or not supporting 2FA.
      - tptacek 5y ago
        DNSSEC and JWT are far more important security issues than the SSO tax; like, it's not even close. None of these are societal issues though; "things that annoy me" are not per se societal issues. "How much a service costs to use properly" simply isn't a societal issue. Just pay what they expect you to pay and move on. Or don't, and don't use the service. I don't see what's complicated about this.
- gkop 5y ago
  It's an indicator that the company favors profits over security.
  - tptacek 5y ago
    Literally every commercial entity, including the ones with the actual best security teams on the planet, favors profits over security in multiple ways.
    - gkop 5y ago
      Yes! Their behavior in public is one of the few signals we have to assess the degree to which they take security seriously behind the scenes. Hence, the SSO tax is an issue to us, we do evaluate companies by their behavior in this regard.
      - tptacek 5y ago
        That's silly, since there are powerful business reasons for companies to charge for SSO integration (see above), and companies routinely make far more important compromises in favor of profits without comparable justification. But you do you.
    - numbsafari 5y ago
      And this is why it is a societal issue. Individuals and companies will do what makes sense for their bottom line in the short-term, even if it is lazy or even self-defeating in the long-term. But if it is bad for society, then it's a societal issue and requires society to intervene.
      - tptacek 5y ago
        Just pay for the service or don't use it. Society will be fine.
- loldk 5y ago

michaelt 5y ago

> As an industry, as a society, we need to make some of these security features easier to implement They're very easy to implement - it just costs money. If you've got enough employees that you need SSO, it's time to move off the free tier. As an industry, as a society, we need to stop expecting developers to deliver services to huge multinationals for $0

tptacek 5y ago

The companies listed on the sso.tax site include many that self-evidently take security extremely seriously, far more so than most of their customers, so I don't know where that leaves your argument. It sounds like you're just not happy that SSO gets used for market seg. I'm not "happy" about it either. That doesn't make it a dark pattern or an indicator that companies "don't take security seriously".

numbsafari 5y ago
The status quo is the problem here. So pointing to the status quo doesn't invalidate my argument. Taking security seriously means you take the security of your customers and your users seriously--not just yourself. I'm sure a lot of those companies take their own security seriously. That doesn't mean they shouldn't be doing a better job for their customers, their users, and the rest of society. It's not just that my feelings are hurt, it's that I personally view this as a societal issue. Our tremendous reliance on this internet thing, and our lax day-to-day security practices and expectations, puts us at serious risk--individually and as a society. You regularly post about the overcomplexity of security protocols and their poor implementation. I'm sure you're more than just "unhappy" about those things. SSO shouldn't be hard to implement relative to, say, MFA--especially since so many use SMS. Auditing should be incredibly straightforward to implement, especially if you are using tools like Rails or Django.
- tptacek 5y ago
  Charging money for SAML integration is simply not a "societal issue".
  - numbsafari 5y ago
    Nor are either JWT or DNSSEC--on their own. But we aren't having a discussion amongst the general population. We're having a discussion amongst people who plan, design, and build these systems and who, as professionals and practitioners, society looks to for input on policy choices. The fact that SSO--and let's be honest, it'd be nice if it weren't always SAML, just like it'd be nice if Google/et.al. didn't force us all to use JWT--is so broadly taxed should be viewed the same way we used to view storing passwords in plain text or not supporting 2FA.
    - tptacek 5y ago
      DNSSEC and JWT are far more important security issues than the SSO tax; like, it's not even close. None of these are societal issues though; "things that annoy me" are not per se societal issues. "How much a service costs to use properly" simply isn't a societal issue. Just pay what they expect you to pay and move on. Or don't, and don't use the service. I don't see what's complicated about this.
gkop 5y ago
It's an indicator that the company favors profits over security.
- tptacek 5y ago
  Literally every commercial entity, including the ones with the actual best security teams on the planet, favors profits over security in multiple ways.
  - gkop 5y ago
    Yes! Their behavior in public is one of the few signals we have to assess the degree to which they take security seriously behind the scenes. Hence, the SSO tax is an issue to us, we do evaluate companies by their behavior in this regard.
    - tptacek 5y ago
      That's silly, since there are powerful business reasons for companies to charge for SSO integration (see above), and companies routinely make far more important compromises in favor of profits without comparable justification. But you do you.
  - numbsafari 5y ago
    And this is why it is a societal issue. Individuals and companies will do what makes sense for their bottom line in the short-term, even if it is lazy or even self-defeating in the long-term. But if it is bad for society, then it's a societal issue and requires society to intervene.
    - tptacek 5y ago
      Just pay for the service or don't use it. Society will be fine.
loldk 5y ago