4 ms·
Look I'll sing LDAP's praises when it's appropriate but this really isn't it. It's less of SSO and more "Same Password Everywhere" which are not at all the same
by Spivak 3y ago
Look I'll sing LDAP's praises when it's appropriate but this really isn't it. It's less of SSO and more "Same Password Everywhere" which are not at all the same experience from the user perspective. It also teaches your users to plug their creds into random login screens instead of the one-true-login-page they can verify is us.
Like as hackers we make fun of the phishing training that teaches you to avoid sketchy links in emails while simultaneously the real emails have the sketchiest links of all time. Using LDAP for this use-case is our version of that.
- caseysoftware 3y ago^ This. We should teach users to put their passwords into very few, limited, and trusted places. The cool new social app is NOT trusted. That random app on your phone is NOT trusted. There's even an xkcd on this one: https://xkcd.com/792/ https://xkcd.com/792/
- pmontra 3y agoThat xkcd is about the downside of using the dame password on many services. No service is really trusted so what we should teach people to do is, as usual, to use a password manager to randomly generate a new password for every service. Maybe that's what you were advocating but it was not clear to me. We should also teach to ourselves to throw away all those weird rules about passwords, like 6 to 15 characters max, letters and digits and a random set of punctuation characters liked by the site owner. Why those limits when they are storing a hash anyway?
- PH95VuimJjqBqy 3y agoname something that doesn't have downsides. go on, I'll wait.
- deleted 3y ago[deleted]
- iimblack 3y agoYikes ignoring that there can be different severity and type of downside
- PH95VuimJjqBqy 3y agosomehow "depends on the specific needs." got turned into "ignoring different severity and downsides". Who knows what goes through people's heads.