4 ms·
The status quo is the problem here. So pointing to the status quo doesn't invalidate my argument. Taking security seriously means you take the security of your
by numbsafari 5y ago
The status quo is the problem here. So pointing to the status quo doesn't invalidate my argument. Taking security seriously means you take the security of your customers and your users seriously--not just yourself. I'm sure a lot of those companies take their own security seriously. That doesn't mean they shouldn't be doing a better job for their customers, their users, and the rest of society.
It's not just that my feelings are hurt, it's that I personally view this as a societal issue. Our tremendous reliance on this internet thing, and our lax day-to-day security practices and expectations, puts us at serious risk--individually and as a society.
You regularly post about the overcomplexity of security protocols and their poor implementation. I'm sure you're more than just "unhappy" about those things.
SSO shouldn't be hard to implement relative to, say, MFA--especially since so many use SMS. Auditing should be incredibly straightforward to implement, especially if you are using tools like Rails or Django.
- tptacek 5y agoCharging money for SAML integration is simply not a "societal issue".
- numbsafari 5y agoNor are either JWT or DNSSEC--on their own. But we aren't having a discussion amongst the general population. We're having a discussion amongst people who plan, design, and build these systems and who, as professionals and practitioners, society looks to for input on policy choices. The fact that SSO--and let's be honest, it'd be nice if it weren't always SAML, just like it'd be nice if Google/et.al. didn't force us all to use JWT--is so broadly taxed should be viewed the same way we used to view storing passwords in plain text or not supporting 2FA.
- tptacek 5y agoDNSSEC and JWT are far more important security issues than the SSO tax; like, it's not even close. None of these are societal issues though; "things that annoy me" are not per se societal issues. "How much a service costs to use properly" simply isn't a societal issue. Just pay what they expect you to pay and move on. Or don't, and don't use the service. I don't see what's complicated about this.