5 ms·

Oops. Here's an unpopular opinion: maybe critical gatekeeping with SSO using OAuth, SAML, and 2FA is something to run on-prem rather than pressing the SaaS "eas

Oops. Here's an unpopular opinion: maybe critical gatekeeping with SSO using OAuth, SAML, and 2FA is something to run on-prem rather than pressing the SaaS "easy button". This includes not only Okta but Auth0 (Okta acquired), Authy, and Duo.

geodel 3y ago
Well, I agree with this but nowadays calculation for on-prem costs is rather rigorous whereas for cloud any nincompoop can come out and say "Look, we converted capex to opex and implemented best of breed auto scalable cloud native solutions" and be hailed as genius. No question will ever be asked to such managers and executives.
- staticautomatic 3y ago
  FYI technology execs stopped citing Capex vs Opex as a driver of cloud use years ago. Source: my day job consisted of interviewing F500 tech execs about why they were moving to the cloud, among other things.
  - geodel 3y ago
    Good. On second thought though it seems worse as Capex vs Opex even though not the greatest thing it is still measurable. While the rest of message is pure bullshittery. Source: I see this communication at (large enterprise) workplace and so many other grand cloud migration pronouncements on internet by executives of F500 companies.
itsthebiz 3y ago
Adding to your unpopular opinion: if it does not NEED to be connected to a network, do not connect it. You actually can write and test software on a system that never gets connected. (Shockingly true!)
- yibg 3y ago
  How does a piece of auth software work without being connected to a network?
  - itsthebiz 3y ago
    See, you’re thinking about it all wrong. Why do you need to allow users to connect? 99/100 times you don’t.
    - Jgrubb 3y ago
      congrats, i have no idea if this is satire or not..
      - xctr94 3y ago
        Excessive irony and sarcasm are a tool some think of as witty, while the rest of us see it as pedantic and childish. I also can’t tell if it’s satire, which goes to show maybe communicating mysteriously has ran its course. Say what you mean, mean what you say.
SV_BubbleTime 3y ago
Is there a DUO on prem? Or are there five solutions I need to deploy and master to get most of their features kinda-sorta for my domain?
StressedDev 3y ago
Unfortunately, running things on-prem will not prevent security breaches and may be far far worse than relying on a cloud vender for authentication. Here is why: 1. All software has security bugs. This includes on-prem software. 2. Many IT groups do not have the expertise to run and secure a directory. You don’t just install some software, setup some accounts, and leave the box in the corner. You have to make sure the system survives disasters, you have to test backups, you have to figure how to determine if you were hacked, etc. This is very hard work. 3. No one has ever shown that on-prem IT security is better than cloud vender IT security. My experience has been that some on-prem IT departments have very poor security. Here are some examples: - One IT department I worked with used a VPN which used an MD5 certificate. This was between 2010 and 2020. MD5 was cracked and it meant anyone could preform a man in the middle attack. - One IT department I worked with deployed a web service which allowed unauthenticated users to access person customer information (national ID/tax number, address, name, phone number, etc.). Note the person doing this knew he was doing something unethical and did it anyway. - One IT department I know of supples nurses with an add supported text editor to type up patient notes. Adware is not know to value privacy and should never be used to process sensitive information. - One IT group I know of will not update Redcap to a supported version. The version of Redcap the IT department uses has known security bugs and the IT department was told about them. The official excuse for not upgrading it is the IT group does not like Redcap. I think Redcap is a piece of software which stores information used in medical studies and used to calculate public health statistics. It contains lots of sensitive data. My main point is moving from the cloud to on-prem may or may not improve security. It really depends on the capability of individual IT groups and many IT groups are not capable of running an identity service like Okta. The other thing to consider is cloud venders typically have much larger budgets and can spread costs over many customers. This means they can afford more security specialists, spend more on securing systems, spend more on detecting breaches, etc.
- jacquesm 3y ago
  On prem systems have the advantage of not being part of a monoculture, so if another party is breached that will not necessarily have immediate impact on your installation.
wkat4242 3y ago
And PingFederate, same story.
conception 3y ago
Dont forget Azure (our root keys are compromised) AD

geodel 3y ago

Well, I agree with this but nowadays calculation for on-prem costs is rather rigorous whereas for cloud any nincompoop can come out and say "Look, we converted capex to opex and implemented best of breed auto scalable cloud native solutions" and be hailed as genius. No question will ever be asked to such managers and executives.

staticautomatic 3y ago
FYI technology execs stopped citing Capex vs Opex as a driver of cloud use years ago. Source: my day job consisted of interviewing F500 tech execs about why they were moving to the cloud, among other things.
- geodel 3y ago
  Good. On second thought though it seems worse as Capex vs Opex even though not the greatest thing it is still measurable. While the rest of message is pure bullshittery. Source: I see this communication at (large enterprise) workplace and so many other grand cloud migration pronouncements on internet by executives of F500 companies.

itsthebiz 3y ago

Adding to your unpopular opinion: if it does not NEED to be connected to a network, do not connect it. You actually can write and test software on a system that never gets connected. (Shockingly true!)

yibg 3y ago
How does a piece of auth software work without being connected to a network?
- itsthebiz 3y ago
  See, you’re thinking about it all wrong. Why do you need to allow users to connect? 99/100 times you don’t.
  - Jgrubb 3y ago
    congrats, i have no idea if this is satire or not..
    - xctr94 3y ago
      Excessive irony and sarcasm are a tool some think of as witty, while the rest of us see it as pedantic and childish. I also can’t tell if it’s satire, which goes to show maybe communicating mysteriously has ran its course. Say what you mean, mean what you say.

SV_BubbleTime 3y ago

Is there a DUO on prem? Or are there five solutions I need to deploy and master to get most of their features kinda-sorta for my domain?

StressedDev 3y ago

Unfortunately, running things on-prem will not prevent security breaches and may be far far worse than relying on a cloud vender for authentication. Here is why: 1. All software has security bugs. This includes on-prem software. 2. Many IT groups do not have the expertise to run and secure a directory. You don’t just install some software, setup some accounts, and leave the box in the corner. You have to make sure the system survives disasters, you have to test backups, you have to figure how to determine if you were hacked, etc. This is very hard work. 3. No one has ever shown that on-prem IT security is better than cloud vender IT security. My experience has been that some on-prem IT departments have very poor security. Here are some examples: - One IT department I worked with used a VPN which used an MD5 certificate. This was between 2010 and 2020. MD5 was cracked and it meant anyone could preform a man in the middle attack. - One IT department I worked with deployed a web service which allowed unauthenticated users to access person customer information (national ID/tax number, address, name, phone number, etc.). Note the person doing this knew he was doing something unethical and did it anyway. - One IT department I know of supples nurses with an add supported text editor to type up patient notes. Adware is not know to value privacy and should never be used to process sensitive information. - One IT group I know of will not update Redcap to a supported version. The version of Redcap the IT department uses has known security bugs and the IT department was told about them. The official excuse for not upgrading it is the IT group does not like Redcap. I think Redcap is a piece of software which stores information used in medical studies and used to calculate public health statistics. It contains lots of sensitive data. My main point is moving from the cloud to on-prem may or may not improve security. It really depends on the capability of individual IT groups and many IT groups are not capable of running an identity service like Okta. The other thing to consider is cloud venders typically have much larger budgets and can spread costs over many customers. This means they can afford more security specialists, spend more on securing systems, spend more on detecting breaches, etc.

jacquesm 3y ago
On prem systems have the advantage of not being part of a monoculture, so if another party is breached that will not necessarily have immediate impact on your installation.

wkat4242 3y ago

And PingFederate, same story.

conception 3y ago

Dont forget Azure (our root keys are compromised) AD