5 ms·

I feel like this article misses the point that SSO is intended to benefit organisations, not users. The selling point is that if an IT department can point a ne

I feel like this article misses the point that SSO is intended to benefit organisations, not users. The selling point is that if an IT department can point a new service at Active Directory or something, it's going to be much less of a headache than managing n sets of user credentials.

throwawayboise 5y ago
That's centralized identity management, not single-sign-on. Single-sign-on is/was supposed to mean you sign on once. I've never seen it actually work.
- Spivak 5y ago
  Yeah, the manifestation of "LDAP Integrated" still means you have to sign into every single service, it just uses the same credentials.
- hinkley 5y ago
  SSO is the source of truth, and centralized identity is the system of record. They go hand in glove. It's not a non-sequitur so much as a tangent.
  - gkop 5y ago
    for the benefit of others (I had to search it): https://www.linkedin.com/pulse/difference-between-system-record-source-truth-santosh-kudva/ https://www.linkedin.com/pulse/difference-between-system-rec...
- Jenk 5y ago
  SSO can be both Single Sign-On, or Same Sign-On. The latter is the LDAP integrated thing - (re)using the same credentials for multiple/disparate services, controlled centrally. The former ("true" single sign-on) is logging in once and accessing everything from there. FWIW there are single sign-on services out there. Okta is used by my current employer, I log into the Okta portal and it has links out to all of the services it supports from there.
- jodrellblank 5y ago
  Single Sign On works beautifully in the Windows environment. Logon to one workstation, access any server's file or print shares, SQL server, IIS websites, and tons of third party software without any logon prompts but still with granular permissions. One of those things people who say "I don't understand why anyone uses Windows" don't understand. Something so pervasive and convenient that "we" the industry have given up in moving everything to the web, along with standard menus, ubiquitous keyboard accelerators for menus and dialog boxes, scripting with the likes of COM, ActiveX, AppleScript, or embedded Python/Lua, local snapshots or volume shadow copy, tools like DNSpy and AutoHotkey and SysExporter able to introspect into running programs and their windows and system controls (and they generally weren't obfuscated javascript inside), being able to see different programs in task switchers without them all being wrapped in a web browser. It was a different and in many ways better world 10-15 years ago.
hinkley 5y ago
I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. On the one hand, Precautionary Principle. The costs of being wrong - and having to explain it to the Board - are just unimaginable. So sure, if you want IT to have a way to push a button and block someone out of the entire network in the time between when their boss says, "Hey, can we talk" and the office door goes 'click', then centralized credentials at least can be somewhat atomic. Session caching, to make this arrangement perform, undermines that immediately of course. On the other hand, when someone accuses you of something way, way out of character, we learn as we mature that it's fairly likely this person did some mental arithmetic that went, "What would I do in this situation?" and that popped out. The person who accuses you of stealing their mug at the drop of a hat may have a passing fancy with stealing mugs themselves. So we learn that in perhaps 95% of cases, non-sequitur suspicions are either the product of the mind of a suspicious person, of someone who is jaded by bad experiences (steal someone's lunch enough times and they will start accusing random people), or of someone who deep down knows they kind of deserve whatever is about to happen. So it troubles me a bit how quickly the C Suite prioritizes having a giant switch to lock people out. I've developed a nervous habit of any time I hear someone getting 'talked to for a second' or suddenly a bunch of 1:1s show up, of cleaning up my computer a little bit, then my desk. Rarely do I have anything that is worthy of cleaning up, but it doesn't hurt and gives me somewhere to put some of that feeling of impending doom. If I had a bad experience of having to clean out a messy desk, I don't remember it very well, but I'm sure it's happened. I know the first time I quit I learned not to try to take everything home on the last day. Somehow my stuff always ends up being bulkier than I estimate.
- Johnny555 5y ago
  I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. Proper offboarding protects you too, not just the company. If you leave the company and someone compromises one of the 27 hard-coded credentials left behind on various machines and services, then it puts you under suspicion. In companies where I do have hard coded creds (including shared passwords), when leaving a company, I compile a list of all of them and send it to my manager and tell them to make sure they are all disabled.
Aeolun 5y ago
No, SSO also helps me. Having only one password to change is really nice. It’s the SSO process that annoys me. Between all the redirects and duplicate information, signin takes 4 times longer than user/password auth.
- toastal 5y ago
  It would also help an adversary that only needs to know your one password.
  - dlp211 5y ago
    Which is why we also use 2FA. You are using 2FA right?
    - toastal 5y ago
      Implying 2FA is bulletproof? I use separate 2FA and passwords for everything.
      - enraged_camel 5y ago
        I don’t think the OP implied that 2FA is bulletproof…
- remram 5y ago
  My company's single-sign-on got upgraded with mandatory 2FA a couple years back, and somehow requires it every time. It's really more of a non-stop-sign-on, I probably do it 10 times on any given day (including waiting for the SMS, etc, I wonder how much this one poorly-configured service costs them).
mooreds 5y ago
I also don't think that the client certificate solution that is trumpeted at the end (for which I don't blame them, content marketing has to content market) is a great option. From the post: "The UX and tech for PKI Infrastructure isn’t great, and the client UX sucks." Guess what, it has for years and years. Deployment is hard. Creating certs at scale for normal users has been available for a long long time, but no one has done that. I think that a more fruitful approach would be to go the webauthn path, and tie into the browser/OS for support (as mentioned in the article). Boom, deployment solved (https://caniuse.com/?search=webauthn https://caniuse.com/?search=webauthn has the list; it's most major browsers on mobile and desktop--the only one missing that I'd love to see add it is FireFox on Android). Now you need to tie into the application and I don't want to diminish that effort. But many apps use libraries or auth servers, so your surface area for deployment is far smaller.
- codebje 5y ago
  Having persisted with user authentication X509 for years, I can in fact tell you the UX got _worse_ over time. We wound up sometimes making key pairs and certificates for end users and emailing them because browser enrollment is so shonky.
tootie 5y ago
Not just miss the point but isn't also just incorrect? SSO typically doesn't require you to login more than once a day. Unless they explicitly set a policy to expire sessions really fast. If you have Okta/Auth0 or the like in your enterprise it should cookie your session in the identity provider and automatically admit you to anything gated by that identity provider
- kelnos 5y ago
  My former employer set expiration at 3 hours. It was super annoying.
- number6 5y ago
  Yes. I sign on by typing my email address and then... redirect... redirect... signed in. Guess the interface could be nicer but generally it's nice

throwawayboise 5y ago

That's centralized identity management, not single-sign-on. Single-sign-on is/was supposed to mean you sign on once. I've never seen it actually work.

Spivak 5y ago
Yeah, the manifestation of "LDAP Integrated" still means you have to sign into every single service, it just uses the same credentials.
hinkley 5y ago
SSO is the source of truth, and centralized identity is the system of record. They go hand in glove. It's not a non-sequitur so much as a tangent.
- gkop 5y ago
  for the benefit of others (I had to search it): https://www.linkedin.com/pulse/difference-between-system-record-source-truth-santosh-kudva/ https://www.linkedin.com/pulse/difference-between-system-rec...
Jenk 5y ago
SSO can be both Single Sign-On, or Same Sign-On. The latter is the LDAP integrated thing - (re)using the same credentials for multiple/disparate services, controlled centrally. The former ("true" single sign-on) is logging in once and accessing everything from there. FWIW there are single sign-on services out there. Okta is used by my current employer, I log into the Okta portal and it has links out to all of the services it supports from there.
jodrellblank 5y ago
Single Sign On works beautifully in the Windows environment. Logon to one workstation, access any server's file or print shares, SQL server, IIS websites, and tons of third party software without any logon prompts but still with granular permissions. One of those things people who say "I don't understand why anyone uses Windows" don't understand. Something so pervasive and convenient that "we" the industry have given up in moving everything to the web, along with standard menus, ubiquitous keyboard accelerators for menus and dialog boxes, scripting with the likes of COM, ActiveX, AppleScript, or embedded Python/Lua, local snapshots or volume shadow copy, tools like DNSpy and AutoHotkey and SysExporter able to introspect into running programs and their windows and system controls (and they generally weren't obfuscated javascript inside), being able to see different programs in task switchers without them all being wrapped in a web browser. It was a different and in many ways better world 10-15 years ago.

hinkley 5y ago

I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. On the one hand, Precautionary Principle. The costs of being wrong - and having to explain it to the Board - are just unimaginable. So sure, if you want IT to have a way to push a button and block someone out of the entire network in the time between when their boss says, "Hey, can we talk" and the office door goes 'click', then centralized credentials at least can be somewhat atomic. Session caching, to make this arrangement perform, undermines that immediately of course. On the other hand, when someone accuses you of something way, way out of character, we learn as we mature that it's fairly likely this person did some mental arithmetic that went, "What would I do in this situation?" and that popped out. The person who accuses you of stealing their mug at the drop of a hat may have a passing fancy with stealing mugs themselves. So we learn that in perhaps 95% of cases, non-sequitur suspicions are either the product of the mind of a suspicious person, of someone who is jaded by bad experiences (steal someone's lunch enough times and they will start accusing random people), or of someone who deep down knows they kind of deserve whatever is about to happen. So it troubles me a bit how quickly the C Suite prioritizes having a giant switch to lock people out. I've developed a nervous habit of any time I hear someone getting 'talked to for a second' or suddenly a bunch of 1:1s show up, of cleaning up my computer a little bit, then my desk. Rarely do I have anything that is worthy of cleaning up, but it doesn't hurt and gives me somewhere to put some of that feeling of impending doom. If I had a bad experience of having to clean out a messy desk, I don't remember it very well, but I'm sure it's happened. I know the first time I quit I learned not to try to take everything home on the last day. Somehow my stuff always ends up being bulkier than I estimate.

Johnny555 5y ago
I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. Proper offboarding protects you too, not just the company. If you leave the company and someone compromises one of the 27 hard-coded credentials left behind on various machines and services, then it puts you under suspicion. In companies where I do have hard coded creds (including shared passwords), when leaving a company, I compile a list of all of them and send it to my manager and tell them to make sure they are all disabled.

Aeolun 5y ago

No, SSO also helps me. Having only one password to change is really nice. It’s the SSO process that annoys me. Between all the redirects and duplicate information, signin takes 4 times longer than user/password auth.

toastal 5y ago
It would also help an adversary that only needs to know your one password.
- dlp211 5y ago
  Which is why we also use 2FA. You are using 2FA right?
  - toastal 5y ago
    Implying 2FA is bulletproof? I use separate 2FA and passwords for everything.
    - enraged_camel 5y ago
      I don’t think the OP implied that 2FA is bulletproof…
remram 5y ago
My company's single-sign-on got upgraded with mandatory 2FA a couple years back, and somehow requires it every time. It's really more of a non-stop-sign-on, I probably do it 10 times on any given day (including waiting for the SMS, etc, I wonder how much this one poorly-configured service costs them).

mooreds 5y ago

I also don't think that the client certificate solution that is trumpeted at the end (for which I don't blame them, content marketing has to content market) is a great option. From the post: "The UX and tech for PKI Infrastructure isn’t great, and the client UX sucks." Guess what, it has for years and years. Deployment is hard. Creating certs at scale for normal users has been available for a long long time, but no one has done that. I think that a more fruitful approach would be to go the webauthn path, and tie into the browser/OS for support (as mentioned in the article). Boom, deployment solved (https://caniuse.com/?search=webauthn https://caniuse.com/?search=webauthn has the list; it's most major browsers on mobile and desktop--the only one missing that I'd love to see add it is FireFox on Android). Now you need to tie into the application and I don't want to diminish that effort. But many apps use libraries or auth servers, so your surface area for deployment is far smaller.

codebje 5y ago
Having persisted with user authentication X509 for years, I can in fact tell you the UX got _worse_ over time. We wound up sometimes making key pairs and certificates for end users and emailing them because browser enrollment is so shonky.

tootie 5y ago

Not just miss the point but isn't also just incorrect? SSO typically doesn't require you to login more than once a day. Unless they explicitly set a policy to expire sessions really fast. If you have Okta/Auth0 or the like in your enterprise it should cookie your session in the identity provider and automatically admit you to anything gated by that identity provider

kelnos 5y ago
My former employer set expiration at 3 hours. It was super annoying.
number6 5y ago
Yes. I sign on by typing my email address and then... redirect... redirect... signed in. Guess the interface could be nicer but generally it's nice