5 ms·
I think something people are missing here is that outsourcing your SSO isn't just about whether it's technically easier to do so, or having the competence to ru
by jon-wood 3y ago
I think something people are missing here is that outsourcing your SSO isn't just about whether it's technically easier to do so, or having the competence to run it. A significant factor is also being able to say on contracts with clients that you use a reputable provider for SSO, who are then on the hook for dealing with all the documentation around precisely how they do that, and how they ensure key material is secured.
In the case of 1Password its a bit more interesting, since they presumably already have all that sorted because that is literally the product that they're selling, but in most cases it's easier to say "no one in the organisation has access to keys" rather than "no one has access, except Bob, because he runs the SSO server, but we really trust him you know".
- codeflo 3y agoI agree about the messaging, but in terms of actual security: What about your service provider’s “Bob”?
- easton 3y agoIf Azure AD was compromised your clients were all probably compromised too, so in that way you’re probably fine. I’m sure that Microsoft/Okta/Google hold the keys in some kind of HSM or whatever, but there’s probably a Bob there that could get in if he really wanted to. You have to figure out what you’re threat modeling for, most people aren’t worried about the big SSO providers being breached because it would be expensive to work around them completely.
- imglorp 3y agoBut AD is compromised and Azure clients are open... https://news.ycombinator.com/item?id=36770235 https://news.ycombinator.com/item?id=36770235
- ilyt 3y agoAnd you can just wash hands because you used "industry's best practice" and continue the security theatre.
- strogonoff 3y agoChoosing a supplier is not washing hands of the issue, if you are a serious business. If you are found to not have done due diligence and have chosen a known vulnerable supplier, you would be seen as equally or more liable compared to having yourself implemented a solution that was found vulnerable. In fact, I imagine your customers can sue you in the former instance and likely win more easily than in the latter (IANAL).
- nostoc 3y agoIt's "Bob" all the way down
- crest 3y agoDon't worry they have a provider too. Oh and that provider is your customer and they store their secret in your secret manager, but you didn't know that until after the post mortem. /s
- selfmodruntime 3y agoThen it's mostly a matter of insurance, so problem solved I guess
- saati 3y ago> no one has access, except Bob, because he runs the SSO server, but we really trust him you know How is Okta better? You trust people who you don't know at all, and they already caused numerous high-profile security incidents.
- linuxftw 3y agoYou can't use reason and logic with the security people. They have a box that needs to be checked, they don't consider any possibilities outside of that box.
- goalieca 3y agoAs a security person, agreed. Too few have ever written a line of code or shipped a product under massive constraints. However, those checkboxes do exist because engineers, IT, and everyone else involved have major lapses. I guarantee you 99% of orgs out there have a worse posture than okta and never find out they've been compromised. I think it's important to admit that _all_ organizations have been hacked. Even the NSA. Most just never find out and if they do they have little idea what was compromised.
- gizmo 3y agoOkta has a well-earned reputation for worst-in-class security practices.
- joshcanhelp 3y agoSource?
- lannisterstark 3y agoNot OP but Okta gets breached like thrice a year.
- FreakLegion 3y ago