3 ms·

It's one day. Often not even a whole day. If that's the worst process in your office then we're golden. If the actual product or developer workflow is that m

by Pxtl 5y ago

It's one day. Often not even a whole day. If that's the worst process in your office then we're golden. If the actual product or developer workflow is that much of a mess? Yes, that's a real problem. But if it's the day-one-never again onboarding? Who gives a crap. The only real pita that carries on is the not-actually-single-sign-on. I'm so goddamned sick of Duo pop-ups, especially my work that has a 20 second timeout on that and sometimes it stalls.

Aachen 5y ago
> It's one day. Often not even a whole day. If that's the worst process in your office... I agree that it's a win if you only ever have one bad day in the office and it's only downhill from here. But if you could, say, not have this bad experience, wouldn't that be even better? Isn't it good to share this experience so that, even if their own employer doesn't take the hint, others might?
hinkley 5y ago
If I can compile the code by sometime after lunch, I consider that a not bad onboarding process. Maybe not great, but not bad. Plenty of places take days to get to this point, often with many false starts. You should be working now. No? Oh, we forgot about this thing. How about now? Still no? Dang. Let me ask David... no wait David is on vacation this week.
- tonyedgecombe 5y ago
  Even when I was contracting people would take a long time to setup an account and PC on my desk, sometimes weeks.
Nextgrid 5y ago
Modern SSO is shit and doesn’t deserve to be called SSO. True SSO is what Kerberos and/or Active Directory has where all the auth is handled out of band and you never ever see a login pop up. SAML/OIDC is a kluge that offers a worse experience than a password manager and in practice means you’ll be interacting with login forms a lot more frequently. Password manager flow: - Open website’s login page, manually, from bookmarks or even the password manager to begin with - login form has username & password field on the same page which the password manager fills and submits - you are logged in “SSO” flow: - Open website’s login page - login form has only email/username, can’t really use a password manager because there’s no password and you don’t want to interfere with the flow (by using a dummy password) because you’ll need your PW manager for the next step and you don’t want the manager stuck on waiting for a password field to appear to fill in that dummy password - wait for (at least one, but typically several) redirects which take a couple seconds (and much worse on flaky mobile connections) - now you fill in your actual SSO credentials - this is where you use your PW manager. - now click through whatever upsells your SSO provider has such as nagging you to use their proprietary 2FA app (another one!) instead of your standard TOTP client - finally go through a few more redirects and end up back on the original site Since the SSO-integrated website has no way to actively tell when your SSO session has expired, it usually defaults to a conservative value which means you need to go through this crap every 12 hours or so. The password manager flow is much much faster. IMO unless you’re able to do proper, real (Kerberos/AD) SSO, just give your employees a good password manager. I understand the technical reasons behind why things are the way they are, but IMO as an industry we should do better and not expose implementation details to the user in such an annoying way. Security shouldn’t be at the detriment of user experience.

by Pxtl 5y ago

Aachen 5y ago

> It's one day. Often not even a whole day. If that's the worst process in your office... I agree that it's a win if you only ever have one bad day in the office and it's only downhill from here. But if you could, say, not have this bad experience, wouldn't that be even better? Isn't it good to share this experience so that, even if their own employer doesn't take the hint, others might?

hinkley 5y ago

If I can compile the code by sometime after lunch, I consider that a not bad onboarding process. Maybe not great, but not bad. Plenty of places take days to get to this point, often with many false starts. You should be working now. No? Oh, we forgot about this thing. How about now? Still no? Dang. Let me ask David... no wait David is on vacation this week.

tonyedgecombe 5y ago
Even when I was contracting people would take a long time to setup an account and PC on my desk, sometimes weeks.

Nextgrid 5y ago

Modern SSO is shit and doesn’t deserve to be called SSO. True SSO is what Kerberos and/or Active Directory has where all the auth is handled out of band and you never ever see a login pop up. SAML/OIDC is a kluge that offers a worse experience than a password manager and in practice means you’ll be interacting with login forms a lot more frequently. Password manager flow: - Open website’s login page, manually, from bookmarks or even the password manager to begin with - login form has username & password field on the same page which the password manager fills and submits - you are logged in “SSO” flow: - Open website’s login page - login form has only email/username, can’t really use a password manager because there’s no password and you don’t want to interfere with the flow (by using a dummy password) because you’ll need your PW manager for the next step and you don’t want the manager stuck on waiting for a password field to appear to fill in that dummy password - wait for (at least one, but typically several) redirects which take a couple seconds (and much worse on flaky mobile connections) - now you fill in your actual SSO credentials - this is where you use your PW manager. - now click through whatever upsells your SSO provider has such as nagging you to use their proprietary 2FA app (another one!) instead of your standard TOTP client - finally go through a few more redirects and end up back on the original site Since the SSO-integrated website has no way to actively tell when your SSO session has expired, it usually defaults to a conservative value which means you need to go through this crap every 12 hours or so. The password manager flow is much much faster. IMO unless you’re able to do proper, real (Kerberos/AD) SSO, just give your employees a good password manager. I understand the technical reasons behind why things are the way they are, but IMO as an industry we should do better and not expose implementation details to the user in such an annoying way. Security shouldn’t be at the detriment of user experience.