11 ms·

An admittedly wandering defense of the SSO tax

88 points by noleary 2y ago

matheist 2y ago
Nice explanation. I'd be interested in hearing from anyone who used to feel negatively about the "SSO tax" and then switched to feeling positive/neutral about it — what changed your mind and why? Vice versa, too. (Not interested in rehashing arguments about why it's good or bad.)
wmf 2y ago
This car with no seat belts, no airbags, and no ABS is just price discrimination! Strangely, no one seems interested in celebrating the implied discount for not having safety.
- noleary 2y ago
  This is a solid objection that I hadn't considered before! Why isn't SAML SSO mandated (either literally or my convention)? Practically speaking, as someone who spends all day trying to convince developers to implement SAML SSO, I really wish this were the case :) I think in practice, software vendors correctly assess that relatively few of their prospective customers actually care. If many small / price sensitive companies really wanted SAML SSO from their vendors -- if there were really meaningful demand -- I imagine we'd see more pricing plans with SAML SSO bundled into entry level tiers. As for mandates, this is a challenging ethical question. I don't think it's necessarily obvious in all cases that some institution should impose safety regulations upon us. There's clearly some set of risks we accept, and some set of risks we don't accept. And we all draw the line in different places. This is pretty obviously true. Not many of us worry about objects randomly falling off buildings. We don't all wear helmets all the time. It's certainly a risk, but do we really care? I think the revealed preference from many software buyers is basically ... no, they don't care about having the security benefits of SSO.
  - wmf 2y ago
    I also don't want to mandate anything but as an industry we have to find some way to do better on security. Free SSO and 2FA with very strong nudges seems like a good path.
  - ameliaquining 2y ago
    On a lot of issues (passwords, SQL injection, automated deployments), buyers originally didn't care much about security, but the security community slowly but surely managed to shift norms and get doing the right thing to become normalized. I think that could happen on SSO too, if not for the fact that it's so effective as a price discriminator, which in turn I think makes it less likely to happen absent some kind of regulation. (Developers at small companies might not care, or they might want to do the right thing but be unable to justify it to the boss; meanwhile, SSO is usually a non-negotiable requirement for enterprises. I think that's a bigger factor than apathy or "price sensitivity" (enterprises are often extremely price-sensitive) in why it's such a good discriminator.) I favor regulation on this, even though it's probably not necessary in every case, simply because I don't see any other way to break this equilibrium.
  - commandar 2y ago
    >This is a solid objection that I hadn't considered before! To be quite frank: this strongly suggests that while you put a lot of effort into writing a long article in defense of the SSO tax, you didn't perform more than the most cursory research about why it's a topic of discussion. This argument is literally above the fold on the two top search results for the term. >In short: SSO is a core security requirement for any company with more than five employees. https://sso.tax/ https://sso.tax/ And the other explicitly makes the car-safety analogy: >Imagine buying a car and the manufacturer asks for an extra payment to unlock 100% of the braking power. Not offering security features if they already exist in your product means a vendor doesn’t care about your security. Our aim is to spotlight vendors who overcharge for security features, in hopes of instigating a change in the industry. https://ssotax.org/ https://ssotax.org/ And to be franker: the word "security" appears exactly once in your entire piece. That's a near-complete avoidance of the actual issue that people are highlighting. I perfectly understand the rationale behind the pricing model. The point is that "only large enterprises need or care about SSO" is completely wrong-headed and detrimental to the overall security posture of any business customer. That is and should be unacceptable.
- tptacek 2y ago
  It is in fact reasonable to charge more for vehicles suitable for commercial fleets and applications than for commuter vehicles.
- google234123 2y ago
  Wasn't it true that for a long time that cheaper cars were just less safe than more expensive cars?
  - wmf 2y ago
    That probably was true... and then we raised the baseline.
- crote 2y ago
  This car comes with a spike pointing out of the steering wheel. For a premium fee we'll replace the spike with an airbag. Why aren't you cheering for the cost-saving spike-flavored steering wheel?
- abigail95 2y ago
  People today will still buy used cars without those features. You would force them to pay more? What if they can't? I wouldn't celebrate taking those cars away from people.
  - michaelmrose 2y ago
    We effectively did tell them they can't by not allowing any vendors to ship a lower cost car without those features. This method of operation in the car industry is incredibly common and has probably saved hundreds of thousands of lives. As far as the older cars without those features allowing them to age out has almost entirely worked.
stackskipton 2y ago
As someone who deals with application support, another big reason is SSO is such a support nightmare. No one wanted to touch SSO tickets because of how frustrating they were to deal with. People wouldn't follow the instructions. Microsoft/Google moved something in their portal and we didn't know so instructions were useless. Microsoft/Google would be having issues and we got tickets because they were still working until tokens expired. Their Admins would turn on 2FA and when their support desk got "Cannot login to $OurProduct", they would just flip it over to us without caring. List goes on and on.
- sparrish 2y ago
  This is the real reason there's an SSO tax. It costs to support SSO, the customers who want SSO should pay for that cost.
  - noleary 2y ago
    I would agree that this cost-plus pricing structure applies in some cases. Some companies definitely want to constrain the universe of SSO users. But this will usually show up in pricing structures with SSO as a relatively inexpensive add-on feature -- not as part of an indivisible bundle. Seemingly we want to talk about both of these things as "the SSO tax" but I think we can agree that they're pretty different scenarios.
  - wmf 2y ago
    I thought some company had free SSO for Google and 365 only and advanced SSO on the enterprise tier. I don't remember which company though, so maybe I made this up.
  - candiddevmike 2y ago
    There are plenty of folks who setup SSO with open source projects without a support contract. Why should they have to pay for it with other software?
    - sethops1 2y ago
anotherhue 2y ago
It's a bad system and you should feel bad for using it. By all means charge enterprises more, but base it on something else, headcount, revenue, non-profit status...whatever. Every time I hear about a data breach I wonder if someone avoided perfectly reasonable SSO protections because of this tax.
- deleted 2y ago
  [deleted]
- colechristensen 2y ago
  If you have enterprise pricing, have substantial enterprise features. That’s it.
- throw10920 2y ago
  > It's a bad system and you should feel bad for using it. What "system" is bad and why? The poster made several arguments - which one of them are you rebutting? The core idea that "you should have to pay more money for more features" makes sense from a basic economics standpoint (regardless of other rationalizations). > I wonder if someone avoided perfectly reasonable SSO protections because of this tax I don't know how much sense this speculation makes. SSO is complex to set up - without data, you could just as easily argue that misconfigured SSO makes breaches more likely, instead of less. Plus, from a more practical standpoint, if you're frustrated about the never-ending stream of breaches (as I am), then it'd be better to push for laws that make the end result (personal data leaked) directly illegal with steep fines. There's too many different "upstream" problems (lack of SSO, default database credentials, buffer overflow in web application, misconfigured authorization system in webapp, etc.) for the strategy of "wage war against them one at a time" to be productive.
TZubiri 2y ago
I get that there's some correlation between hacker culture and piracy and free as in gratis. But lately I've seen a flood of flat out complaining about things costing money. As software devs we should be for software having a price tag, not against it
- langcss 2y ago
  The complaint isn't about anything costing money. It is about making SSO an enterprise feature which pushes the price up alot. At the same time SSO is good for security. So it is like an office space charging double for swipe cards instead of a number lock. I think what annoys people is the reason why: a way to make more money from enterprises, and that they could make that money some other way.
  - happyopossum 2y ago
    > So it is like an office space charging double for swipe cards instead of a number lock. If the landlord had to hire a bunch of extra support people, with expertise outside their normal domain, just to support swipe cards then this would make sense, no? I can imagine a lot of products where accompany literally could not afford to provide support for SSO issues to a basic tier customer with 100 employees
    - langcss 2y ago
      Not really. Especially if both systems are already in place and they just need to turn it on. The swipe system should be a very minor or zero part of the rent, not double.
      - throw10920 2y ago
        > Not really. Especially if both systems are already in place and they just need to turn it on. This isn't a valid analogy to SSO. SSO doesn't just cost extra to develop (which in itself is a valid reason for charging more), but it costs extra to maintain - you can find several other comments in this thread alone talking about how difficult it is to support SSO from a technical/customer service perspective. People are expensive - both when writing code, and when supporting it.
deleted 2y ago
[deleted]
happyopossum 2y ago
My job involves working with customers to test out products - has for years, and for several jobs. None of my products have ever charged extra for SSO, and most require it, so I get to deal with it all the time. For the past 5+ years, the part of configuration that takes the longest - by far - is always SSO. I cannot imagine the amount of added support calls, time, and frustration brought about by it, so I can completely understand why some companies gate it behind more expensive tiers.
SOLAR_FIELDS 2y ago
The reality is much simpler than the article would have you believe. The article goes through all these convoluted explanations about value add but the simple fact of the matter is that SSO is the one differentiator that businesses will guarantee pay for. The other features are often unknown to stakeholders outside of the internal champion and need explanation oftentimes. But SSO, enterprises always need at a certain scale. So it’s incredibly effective because it’s the one feature that every single enterprise that wants to purchase your product cannot do without. In fact, the exact opposite conclusion of the article is reached if we follow this logic. One of the taglines reads: Buyers want different things. Well, maybe the stakeholder/champion actually using your software might. But often they are not the ones that are making the money decision in an organization. The people who ARE making that decision, however, do not want different things. They probably could care less about different things. They want SSO.
- karlgkk 2y ago
  I think the friction here is from midsized companies. Where onboarding software that’s purchased is much harder than free software. I think it might be worth saying “SSO is free, up to n users”. Also this is pricing for “adequate security”, which rubs a lot of people the wrong way. But I do agree, competent, organizational wide SSO with SCIM is definitely an enterprise feature.
  - SOLAR_FIELDS 2y ago
    As I pointed out in a sibling thread, most SaaS offer “SSO at home” eg oauth2/oidc via either Google idp or GitHub in lower tiers, often in free tiers. So to get “adequate security” you don’t necessarily have to pay the SSO tax, but your alternative is that you must be locked to one of those two vendors, which is of course not ideal at all. But to say you have to pay the SSO tax to get “adequate security” is not really true at face value because of this. That being said, obviously this situation as described sucks and we should not move towards it because really all it does is push SaaS startups towards these two vendors to punt huge licensing fees down the road until they have the revenue to support it. And by then they are significantly locked in to these specific two vendors, two vendors that already have problematic approaches to monopolizing certain things. So fixing this is important but for a different reason than one might take at face value.
paxys 2y ago
This is a good economics lesson but fails to address the actual issue people have with the SSO tax. It isn't about the concept of price discrimination, but price discrimination when it comes to security. You can charge extra for convenience features or other value-add features, sure, but the choice of login provider is something that should be table stakes for every person and every organization regardless of how big they are or how much they can pay. An even worse example – plenty of apps gate two-factor auth behind a paid tier as well.
- SOLAR_FIELDS 2y ago
  Sure, but most SaaS support “SSO at home” in lower tiers via either Google idp or GitHub. So yes you’re locked into those vendors which kind of sucks but it’s not necessarily true that you have to give up security without forking over the “SSO tax”
  - mynameisvlad 2y ago
    I mean, no. If they supported BYOSSO then they wouldn’t be, by definition, charging an SSO tax. People are using the term when SSO as a concept is gated behind a paywall.
- tptacek 2y ago
  There's no moral valence to price discrimination on enterprise security features.
- SoftTalker 2y ago
  A customer who wants SSO is signaling that they are using this product in their business operations. I.e. they are making money from it. They aren't just learning it, or using it as a hobby. Therefore the product vendor is going to charge the customer at least some approximation of the value the customer is gaining from the product.
  - e_y_ 2y ago
    The amount of money and budget that a company has can vary wildly. Just because your company uses SSO doesn't mean you're a Fortune 500. Of course this mostly means that if your required feature set falls into the "Contact us for pricing" tier then you're going to have to talk to a sales rep (probably several, from different vendors so you have a competitive quote) instead of getting any kind transparent pricing.
JohnMakin 2y ago
This reminds me of when several years ago I was a pretty early enterprise Vault user - I poc'd out a pretty simple implementation with the OSS version that at that time included SSO support with Okta. Management was like "great we don't have to pay for any of this then, let's use OSS then" and I argued that there was zero chance they were going to leave that as a OSS feature, sure enough, some months later they rug pulled it. It was pretty much the only additional feature outside of core functionality we absolutely "needed," everything else was pretty fluff.
tomrod 2y ago
Neat advertisement to drum up support for easily adding SSO with an open source tooling.
icambron 2y ago
I don’t really mind paying for SSO. It’s fine. But I hate that it’s the one feature in the “enterprise” tier that I need, and now I have to talk to a sales rep and sign a contract. You could have just charged me more per seat and it would have been better for both of us. Instead I looked for another vendor that didn’t let their sales team convince them to let the AEs gatekeep a basic feature.
ivan_gammel 2y ago
I was responsible for IT in a hypergrowth scale-up and I don’t like this article, it misrepresents the problem. The problem is, when you are big enough to set up SSO like Okta, you have to upgrade nearly all of your subscriptions in a short time to make use of it, suddenly resulting in a huge increase in the budget. So, let’s say the business goes from X to 2X in revenue and from X to almost 2X in staff (let’s assume there’s some small increase in productivity over time). In some incredible logical twist every SaaS provider thinks that 2X increase in price is affordable, despite that the company is still burning money and the enterprise features aren’t really needed yet. 2X budget isn’t approved by CFO, cost-cutting exercise starts and price increase is matched by significant reduction in number of licenses. Did it worth it? Not sure. Volume-based pricing complimented by feature add-ons would do a good job too.
- danenania 2y ago
  Let’s not forget that the whole reason your company needs to upgrade all its subscriptions for SSO is so it can get a soc2 and offer its own high-priced enterprise plan (which is probably gated by SSO).
  - ivan_gammel 2y ago
    Do you realize there exist other types of businesses?
dakial1 2y ago
This is the same way all airlines in the world work since the invention of Revenue/Yield Management. Which is basically price discrimination to get the biggest piece of the value. Airlines will mostly segment client based on things like Minimum Stay (in destination) and how many days before the flight the ticket was bought to find the most desired of all users: The business traveler. SSO is (roughly) the same thing, companies who would like SSO are probably the ones in the corporate level, and this is an efficient way to find them. Of course there are false positives, but software companies are willing to live with those to get the biggest part of the pie. And this is actually good for users, as it allows for the other users who have more flexibility to pay a lot less (both at airlines and software) than they would pay if those companies didn't discriminate.
Terretta 2y ago
This argument misses the mark that SSO tax is charging extra for a practice that: (a) BnL everyone should do, (b) reduces the SaaS provider's liability, (c) is incredibly costly to change/transition how it's done after initial setup, (d) actually doesn't add much overhead when using poor-man's SSO aka OIDC/OAuth2* (the now ubiquitous "sign in with" or "continue with" buttons that require zero integration once set up once), (e) drags in a host of other odious interactions most buyers want nothing to do with (Call Us? Why?), and (f) is bad for industry trust as a whole. Also, people wouldn't even mind if you added $2/user so you can't lose their creds and they don't have to remember your password. (For comparison, all of Microsoft E5 security tools together add ~$20 to M365.) If you really want a differentiator they have to pay for that isn't SSO, go with "audit logs", "RBAC", and "Team Roles" management as lifts. Most anyone required to use SSO is required to use vendors that support audit logs. For SSO itself, you can also still charge for "automated group provisioning" (what used to be SCIM in SSO world). By the time they care about teams, they care about this. See more features to charge for here: https://www.enterpriseready.io/ https://www.enterpriseready.io/ * This is on top of the argument from elsewhere in this thread, "Use our Google login then..." Note to the B2B startup bubble: more of your potential small, mid, and Fortune 500 business customers (where customer headcount > 1) can "Sign in with" Microsoft than Google. (Some estimates put it at 85%). Meanwhile, what startups and businesses on each side of B2B think they need legacy SSO/SAML for, most can actually meet all their requirements with this far more straightforward approach combined with a domain name control check and email domain filter.
philipwhiuk 2y ago
This a terrible defence. The reason there's a belief of an SSO tax is not that you have to pay more to get SSO, it's that companies use SSO to get you to pay for features no-one ever wanted but they did a lot of development on because they know you need SSO. And the gatekeeping of it behind sales people.
- happyopossum 2y ago
  > features no-one ever wanted but they did a lot of development on because they know you need SSO. I’ve been around product development for 20+ years and I have NEVER seen a feature that “no-one ever wanted” get a lot of development resources. What I see a lot are features that a few huge customers want get those resources, and other people without that perspective write them off as useless. Meanwhile we’re closing 9 figure deals on the backs of those “useless” features.
  - rpigab 2y ago
    Ad placement in software? Not many users appreciate it, and usually it's implemented to create value for the software company, not for the user. And yet it usually gets a lot of development resources.
AnthonyMouse 2y ago
This argument is basically wrong because it supposes companies don't have market power when they do. "Market power" doesn't mean monopoly. It takes at least four and more often at least a dozen viable competitors before you have enough that there isn't an implicit cartel, and there are altogether too many markets where this is the case. Nearly all specialty or line of business software, for example. These markets commonly have two or three providers and rarely have hundreds. Literally the intended purpose of copyright in this context is to give the authors market power. And then the example given is the sympathetic one. The premise here is that there are the same number of customers willing to pay $40 as $10, and so the rational choice for a company not engaged in price discrimination is to charge $40 to everyone and price discrimination allows them to provide a "discount" to half of the customers. Now suppose that only 10% of the customers would be willing to pay $40. The single-price profit-maximizing strategy is then to charge $10, because 100% x $10 is more than 10% x $40, and no customer benefits because all price discrimination does is allow them to overcharge the remaining 10%. More to the point, in an actually competitive market, price discrimination isn't possible. If the marginal cost of providing the service is $7 and anyone is charging $40 to anyone, someone else could take those customers by charging $39, and someone else could take their customers by charging $25, until the market price is a thin margin over the underlying cost of providing the service. Because even the customers willing to pay $40 would prefer to pay $8, and the company that has 0.25% market share at $40 would rather have 10% market share at $8. The better argument in favor of the "SSO tax" is the one from the comments: That SSO actually increases the cost of providing the service by raising support costs.
- noleary 2y ago
  I can identify basically three criticisms of my argument in your post. (1) That I assume companies never have market power. (2) That I suppose "market power" implies monopoly (3) That my example was cherry-picked. 1. I did no such thing. I explicitly acknowledged market power several times. 2. Again, not correct. I explicitly mentioned oligopoly (assuming that 'imperfect competition' wouldn't land). 3. Of course it was. I acknowledged as much! I quite literally said the example doesn't generalize. The example serves to illustrate a 'there exists' claim. I felt a concrete example would be easier to follow than some kind of generalized model. Your own comment claims that "actually competitive" markets can't have price discrimination. Sure, we can suppose the law of one price applies to perfectly competitive markets, but there's no sense in which a perfectly competitive markets "actually" exist at all! The obvious observation we can make is that such competitive dynamics imply that no one would make any profit! My appeal to the airline industry as an example was not an accident. There's a very well-established literature on the relationship between competition and discrimination in the airline business. It's *certainly* not a settled question that discrimination decreases as competition intensifies. I included a classic from Stavins below that finds precisely the opposite of your claim. My argument here isn't perfect. I can think of many flaws, many reasonable objections. But I don't think you're using any of them here. ---- Referenced paper from Stavins: https://www.bostonfed.org/publications/research-department-working-paper/1996/price-discrimination-in-the-airline-market-the-effect-of-market-concentration.aspx https://www.bostonfed.org/publications/research-department-w...
johngalt 2y ago
No problem at all with the concept of price discrimination. The economics make sense. In any scenario where unit costs are low, but development costs are high, the ideal situation is where everyone gets the benefit of having the product at a price they are willing to pay. Maximizes total value to all parties. The problem with the SSO tax is that it wedges itself into the pre-existing cracks in most organizations. Security practitioners are already in conflict with other departments. What happens when a department head has pitched a new SaaS as being 1x price, but then it becomes 2x price after the security team's requirements are added? It is not seen as the [application is expensive], it seen as [security team's requirements have doubled the price]. Conversely a price discrimination strategy which locks specific user facing features behind a specific tiers means that the same person championing the software, would also advocate for the appropriate payment tier. Price discrimination is a valid strategy. Responding to organizations who are actively making the security practitioners job more difficult is also valid.
jessriedel 2y ago
> Some of us believe that all parties should pay a fair price, the same price for a given product or service. I have some sympathy for that perspective. I myself have felt tempted to describe certain prices as ripoffs, saying something like “a bottle of water should not cost $8” while waiting to board a flight at SFO. It’s very natural for us to say things like that. Airports are natural, government-administered monopolies, who then typically auction off the rights for firms to sell to a captive audience with little to no competition. This typically results in unfair and wasteful allocation of resources.
phkx 2y ago
I can‘t help to observe that the shapes in the article can be sorted by color and shape, with each resulting stack being numbered from 1 to 4. Problem solved ;)
Woshiwuja 2y ago
Coursera 12400% Increase is CRAZY
abigail95 2y ago
Coming in late to this discussion but I take issue with people framing charging more for features as price discrimination. It's not, it's selling more features for more money.
michaelmrose 2y ago
> We can’t live in a world with zero profit. And who should determine what reasonable profits might be? The society under whose umbrella we operate. > a bottle of water should not cost $8” while waiting to board a flight at SFO. It’s very natural for us to say things like that. The problem is the bottle of water is only worth $8 in part because they keep you from bringing in drinks not because its especially valuable at that time and place. It's the difference between actually creating value and exploiting people out of their money
physicsguy 2y ago
Implementing SSO is a nightmare, particularly if customers want controls on their side. My view is that you should use Cognito (simple) or Auth0 (simple but expensive) and build a self-setup page for it. Then if customers want it, it's on them to deal with configuring. Oh, and push them all to OpenID because it's a lot less hassle than SAML. If you're selling to big businesses (and you generally want to be), they'll pay for it anyway because this sort of security thing falls under various box ticking exercises for ISO certifications.
carus 2y ago
It appears that many of the complaints in this thread are related to the complexities of SAML. I configure, manage, and troubleshoot many SSO configurations in my work but they are all OAuth2/OIDC based and find them really quite simple, easy to understand, and the RFC's a pleasure to read. Has anyone used both SAML and OIDC in their career and could comment on whether I avoided a difficult time in SSO with SAML, or am I just unaware of the difficulties because its what I regularly work with...

88 points by noleary 2y ago

Nice explanation. I'd be interested in hearing from anyone who used to feel negatively about the "SSO tax" and then switched to feeling positive/neutral about it — what changed your mind and why? Vice versa, too. (Not interested in rehashing arguments about why it's good or bad.)

wmf 2y ago

This car with no seat belts, no airbags, and no ABS is just price discrimination! Strangely, no one seems interested in celebrating the implied discount for not having safety.

noleary 2y ago
This is a solid objection that I hadn't considered before! Why isn't SAML SSO mandated (either literally or my convention)? Practically speaking, as someone who spends all day trying to convince developers to implement SAML SSO, I really wish this were the case :) I think in practice, software vendors correctly assess that relatively few of their prospective customers actually care. If many small / price sensitive companies really wanted SAML SSO from their vendors -- if there were really meaningful demand -- I imagine we'd see more pricing plans with SAML SSO bundled into entry level tiers. As for mandates, this is a challenging ethical question. I don't think it's necessarily obvious in all cases that some institution should impose safety regulations upon us. There's clearly some set of risks we accept, and some set of risks we don't accept. And we all draw the line in different places. This is pretty obviously true. Not many of us worry about objects randomly falling off buildings. We don't all wear helmets all the time. It's certainly a risk, but do we really care? I think the revealed preference from many software buyers is basically ... no, they don't care about having the security benefits of SSO.
- wmf 2y ago
  I also don't want to mandate anything but as an industry we have to find some way to do better on security. Free SSO and 2FA with very strong nudges seems like a good path.
- ameliaquining 2y ago
  On a lot of issues (passwords, SQL injection, automated deployments), buyers originally didn't care much about security, but the security community slowly but surely managed to shift norms and get doing the right thing to become normalized. I think that could happen on SSO too, if not for the fact that it's so effective as a price discriminator, which in turn I think makes it less likely to happen absent some kind of regulation. (Developers at small companies might not care, or they might want to do the right thing but be unable to justify it to the boss; meanwhile, SSO is usually a non-negotiable requirement for enterprises. I think that's a bigger factor than apathy or "price sensitivity" (enterprises are often extremely price-sensitive) in why it's such a good discriminator.) I favor regulation on this, even though it's probably not necessary in every case, simply because I don't see any other way to break this equilibrium.
- commandar 2y ago
  >This is a solid objection that I hadn't considered before! To be quite frank: this strongly suggests that while you put a lot of effort into writing a long article in defense of the SSO tax, you didn't perform more than the most cursory research about why it's a topic of discussion. This argument is literally above the fold on the two top search results for the term. >In short: SSO is a core security requirement for any company with more than five employees. https://sso.tax/ https://sso.tax/ And the other explicitly makes the car-safety analogy: >Imagine buying a car and the manufacturer asks for an extra payment to unlock 100% of the braking power. Not offering security features if they already exist in your product means a vendor doesn’t care about your security. Our aim is to spotlight vendors who overcharge for security features, in hopes of instigating a change in the industry. https://ssotax.org/ https://ssotax.org/ And to be franker: the word "security" appears exactly once in your entire piece. That's a near-complete avoidance of the actual issue that people are highlighting. I perfectly understand the rationale behind the pricing model. The point is that "only large enterprises need or care about SSO" is completely wrong-headed and detrimental to the overall security posture of any business customer. That is and should be unacceptable.
tptacek 2y ago
It is in fact reasonable to charge more for vehicles suitable for commercial fleets and applications than for commuter vehicles.
google234123 2y ago
Wasn't it true that for a long time that cheaper cars were just less safe than more expensive cars?
- wmf 2y ago
  That probably was true... and then we raised the baseline.
crote 2y ago
This car comes with a spike pointing out of the steering wheel. For a premium fee we'll replace the spike with an airbag. Why aren't you cheering for the cost-saving spike-flavored steering wheel?
abigail95 2y ago
People today will still buy used cars without those features. You would force them to pay more? What if they can't? I wouldn't celebrate taking those cars away from people.
- michaelmrose 2y ago
  We effectively did tell them they can't by not allowing any vendors to ship a lower cost car without those features. This method of operation in the car industry is incredibly common and has probably saved hundreds of thousands of lives. As far as the older cars without those features allowing them to age out has almost entirely worked.

stackskipton 2y ago

As someone who deals with application support, another big reason is SSO is such a support nightmare. No one wanted to touch SSO tickets because of how frustrating they were to deal with. People wouldn't follow the instructions. Microsoft/Google moved something in their portal and we didn't know so instructions were useless. Microsoft/Google would be having issues and we got tickets because they were still working until tokens expired. Their Admins would turn on 2FA and when their support desk got "Cannot login to $OurProduct", they would just flip it over to us without caring. List goes on and on.

sparrish 2y ago
This is the real reason there's an SSO tax. It costs to support SSO, the customers who want SSO should pay for that cost.
- noleary 2y ago
  I would agree that this cost-plus pricing structure applies in some cases. Some companies definitely want to constrain the universe of SSO users. But this will usually show up in pricing structures with SSO as a relatively inexpensive add-on feature -- not as part of an indivisible bundle. Seemingly we want to talk about both of these things as "the SSO tax" but I think we can agree that they're pretty different scenarios.
- wmf 2y ago
  I thought some company had free SSO for Google and 365 only and advanced SSO on the enterprise tier. I don't remember which company though, so maybe I made this up.
- candiddevmike 2y ago
  There are plenty of folks who setup SSO with open source projects without a support contract. Why should they have to pay for it with other software?
  - sethops1 2y ago

anotherhue 2y ago

It's a bad system and you should feel bad for using it. By all means charge enterprises more, but base it on something else, headcount, revenue, non-profit status...whatever. Every time I hear about a data breach I wonder if someone avoided perfectly reasonable SSO protections because of this tax.

deleted 2y ago
[deleted]
colechristensen 2y ago
If you have enterprise pricing, have substantial enterprise features. That’s it.
throw10920 2y ago
> It's a bad system and you should feel bad for using it. What "system" is bad and why? The poster made several arguments - which one of them are you rebutting? The core idea that "you should have to pay more money for more features" makes sense from a basic economics standpoint (regardless of other rationalizations). > I wonder if someone avoided perfectly reasonable SSO protections because of this tax I don't know how much sense this speculation makes. SSO is complex to set up - without data, you could just as easily argue that misconfigured SSO makes breaches more likely, instead of less. Plus, from a more practical standpoint, if you're frustrated about the never-ending stream of breaches (as I am), then it'd be better to push for laws that make the end result (personal data leaked) directly illegal with steep fines. There's too many different "upstream" problems (lack of SSO, default database credentials, buffer overflow in web application, misconfigured authorization system in webapp, etc.) for the strategy of "wage war against them one at a time" to be productive.

TZubiri 2y ago

I get that there's some correlation between hacker culture and piracy and free as in gratis. But lately I've seen a flood of flat out complaining about things costing money. As software devs we should be for software having a price tag, not against it

langcss 2y ago
The complaint isn't about anything costing money. It is about making SSO an enterprise feature which pushes the price up alot. At the same time SSO is good for security. So it is like an office space charging double for swipe cards instead of a number lock. I think what annoys people is the reason why: a way to make more money from enterprises, and that they could make that money some other way.
- happyopossum 2y ago
  > So it is like an office space charging double for swipe cards instead of a number lock. If the landlord had to hire a bunch of extra support people, with expertise outside their normal domain, just to support swipe cards then this would make sense, no? I can imagine a lot of products where accompany literally could not afford to provide support for SSO issues to a basic tier customer with 100 employees
  - langcss 2y ago
    Not really. Especially if both systems are already in place and they just need to turn it on. The swipe system should be a very minor or zero part of the rent, not double.
    - throw10920 2y ago
      > Not really. Especially if both systems are already in place and they just need to turn it on. This isn't a valid analogy to SSO. SSO doesn't just cost extra to develop (which in itself is a valid reason for charging more), but it costs extra to maintain - you can find several other comments in this thread alone talking about how difficult it is to support SSO from a technical/customer service perspective. People are expensive - both when writing code, and when supporting it.

deleted 2y ago

[deleted]

happyopossum 2y ago

My job involves working with customers to test out products - has for years, and for several jobs. None of my products have ever charged extra for SSO, and most require it, so I get to deal with it all the time. For the past 5+ years, the part of configuration that takes the longest - by far - is always SSO. I cannot imagine the amount of added support calls, time, and frustration brought about by it, so I can completely understand why some companies gate it behind more expensive tiers.

SOLAR_FIELDS 2y ago

The reality is much simpler than the article would have you believe. The article goes through all these convoluted explanations about value add but the simple fact of the matter is that SSO is the one differentiator that businesses will guarantee pay for. The other features are often unknown to stakeholders outside of the internal champion and need explanation oftentimes. But SSO, enterprises always need at a certain scale. So it’s incredibly effective because it’s the one feature that every single enterprise that wants to purchase your product cannot do without. In fact, the exact opposite conclusion of the article is reached if we follow this logic. One of the taglines reads: Buyers want different things. Well, maybe the stakeholder/champion actually using your software might. But often they are not the ones that are making the money decision in an organization. The people who ARE making that decision, however, do not want different things. They probably could care less about different things. They want SSO.

karlgkk 2y ago
I think the friction here is from midsized companies. Where onboarding software that’s purchased is much harder than free software. I think it might be worth saying “SSO is free, up to n users”. Also this is pricing for “adequate security”, which rubs a lot of people the wrong way. But I do agree, competent, organizational wide SSO with SCIM is definitely an enterprise feature.
- SOLAR_FIELDS 2y ago
  As I pointed out in a sibling thread, most SaaS offer “SSO at home” eg oauth2/oidc via either Google idp or GitHub in lower tiers, often in free tiers. So to get “adequate security” you don’t necessarily have to pay the SSO tax, but your alternative is that you must be locked to one of those two vendors, which is of course not ideal at all. But to say you have to pay the SSO tax to get “adequate security” is not really true at face value because of this. That being said, obviously this situation as described sucks and we should not move towards it because really all it does is push SaaS startups towards these two vendors to punt huge licensing fees down the road until they have the revenue to support it. And by then they are significantly locked in to these specific two vendors, two vendors that already have problematic approaches to monopolizing certain things. So fixing this is important but for a different reason than one might take at face value.

paxys 2y ago

This is a good economics lesson but fails to address the actual issue people have with the SSO tax. It isn't about the concept of price discrimination, but price discrimination when it comes to security. You can charge extra for convenience features or other value-add features, sure, but the choice of login provider is something that should be table stakes for every person and every organization regardless of how big they are or how much they can pay. An even worse example – plenty of apps gate two-factor auth behind a paid tier as well.

SOLAR_FIELDS 2y ago
Sure, but most SaaS support “SSO at home” in lower tiers via either Google idp or GitHub. So yes you’re locked into those vendors which kind of sucks but it’s not necessarily true that you have to give up security without forking over the “SSO tax”
- mynameisvlad 2y ago
  I mean, no. If they supported BYOSSO then they wouldn’t be, by definition, charging an SSO tax. People are using the term when SSO as a concept is gated behind a paywall.
tptacek 2y ago
There's no moral valence to price discrimination on enterprise security features.
SoftTalker 2y ago
A customer who wants SSO is signaling that they are using this product in their business operations. I.e. they are making money from it. They aren't just learning it, or using it as a hobby. Therefore the product vendor is going to charge the customer at least some approximation of the value the customer is gaining from the product.
- e_y_ 2y ago
  The amount of money and budget that a company has can vary wildly. Just because your company uses SSO doesn't mean you're a Fortune 500. Of course this mostly means that if your required feature set falls into the "Contact us for pricing" tier then you're going to have to talk to a sales rep (probably several, from different vendors so you have a competitive quote) instead of getting any kind transparent pricing.

JohnMakin 2y ago

This reminds me of when several years ago I was a pretty early enterprise Vault user - I poc'd out a pretty simple implementation with the OSS version that at that time included SSO support with Okta. Management was like "great we don't have to pay for any of this then, let's use OSS then" and I argued that there was zero chance they were going to leave that as a OSS feature, sure enough, some months later they rug pulled it. It was pretty much the only additional feature outside of core functionality we absolutely "needed," everything else was pretty fluff.

tomrod 2y ago

Neat advertisement to drum up support for easily adding SSO with an open source tooling.

icambron 2y ago

I don’t really mind paying for SSO. It’s fine. But I hate that it’s the one feature in the “enterprise” tier that I need, and now I have to talk to a sales rep and sign a contract. You could have just charged me more per seat and it would have been better for both of us. Instead I looked for another vendor that didn’t let their sales team convince them to let the AEs gatekeep a basic feature.

ivan_gammel 2y ago

I was responsible for IT in a hypergrowth scale-up and I don’t like this article, it misrepresents the problem. The problem is, when you are big enough to set up SSO like Okta, you have to upgrade nearly all of your subscriptions in a short time to make use of it, suddenly resulting in a huge increase in the budget. So, let’s say the business goes from X to 2X in revenue and from X to almost 2X in staff (let’s assume there’s some small increase in productivity over time). In some incredible logical twist every SaaS provider thinks that 2X increase in price is affordable, despite that the company is still burning money and the enterprise features aren’t really needed yet. 2X budget isn’t approved by CFO, cost-cutting exercise starts and price increase is matched by significant reduction in number of licenses. Did it worth it? Not sure. Volume-based pricing complimented by feature add-ons would do a good job too.

danenania 2y ago
Let’s not forget that the whole reason your company needs to upgrade all its subscriptions for SSO is so it can get a soc2 and offer its own high-priced enterprise plan (which is probably gated by SSO).
- ivan_gammel 2y ago
  Do you realize there exist other types of businesses?

dakial1 2y ago

This is the same way all airlines in the world work since the invention of Revenue/Yield Management. Which is basically price discrimination to get the biggest piece of the value. Airlines will mostly segment client based on things like Minimum Stay (in destination) and how many days before the flight the ticket was bought to find the most desired of all users: The business traveler. SSO is (roughly) the same thing, companies who would like SSO are probably the ones in the corporate level, and this is an efficient way to find them. Of course there are false positives, but software companies are willing to live with those to get the biggest part of the pie. And this is actually good for users, as it allows for the other users who have more flexibility to pay a lot less (both at airlines and software) than they would pay if those companies didn't discriminate.

Terretta 2y ago

This argument misses the mark that SSO tax is charging extra for a practice that: (a) BnL everyone should do, (b) reduces the SaaS provider's liability, (c) is incredibly costly to change/transition how it's done after initial setup, (d) actually doesn't add much overhead when using poor-man's SSO aka OIDC/OAuth2* (the now ubiquitous "sign in with" or "continue with" buttons that require zero integration once set up once), (e) drags in a host of other odious interactions most buyers want nothing to do with (Call Us? Why?), and (f) is bad for industry trust as a whole. Also, people wouldn't even mind if you added $2/user so you can't lose their creds and they don't have to remember your password. (For comparison, all of Microsoft E5 security tools together add ~$20 to M365.) If you really want a differentiator they have to pay for that isn't SSO, go with "audit logs", "RBAC", and "Team Roles" management as lifts. Most anyone required to use SSO is required to use vendors that support audit logs. For SSO itself, you can also still charge for "automated group provisioning" (what used to be SCIM in SSO world). By the time they care about teams, they care about this. See more features to charge for here: https://www.enterpriseready.io/ https://www.enterpriseready.io/ * This is on top of the argument from elsewhere in this thread, "Use our Google login then..." Note to the B2B startup bubble: more of your potential small, mid, and Fortune 500 business customers (where customer headcount > 1) can "Sign in with" Microsoft than Google. (Some estimates put it at 85%). Meanwhile, what startups and businesses on each side of B2B think they need legacy SSO/SAML for, most can actually meet all their requirements with this far more straightforward approach combined with a domain name control check and email domain filter.

philipwhiuk 2y ago

This a terrible defence. The reason there's a belief of an SSO tax is not that you have to pay more to get SSO, it's that companies use SSO to get you to pay for features no-one ever wanted but they did a lot of development on because they know you need SSO. And the gatekeeping of it behind sales people.

happyopossum 2y ago
> features no-one ever wanted but they did a lot of development on because they know you need SSO. I’ve been around product development for 20+ years and I have NEVER seen a feature that “no-one ever wanted” get a lot of development resources. What I see a lot are features that a few huge customers want get those resources, and other people without that perspective write them off as useless. Meanwhile we’re closing 9 figure deals on the backs of those “useless” features.
- rpigab 2y ago
  Ad placement in software? Not many users appreciate it, and usually it's implemented to create value for the software company, not for the user. And yet it usually gets a lot of development resources.

AnthonyMouse 2y ago

This argument is basically wrong because it supposes companies don't have market power when they do. "Market power" doesn't mean monopoly. It takes at least four and more often at least a dozen viable competitors before you have enough that there isn't an implicit cartel, and there are altogether too many markets where this is the case. Nearly all specialty or line of business software, for example. These markets commonly have two or three providers and rarely have hundreds. Literally the intended purpose of copyright in this context is to give the authors market power. And then the example given is the sympathetic one. The premise here is that there are the same number of customers willing to pay $40 as $10, and so the rational choice for a company not engaged in price discrimination is to charge $40 to everyone and price discrimination allows them to provide a "discount" to half of the customers. Now suppose that only 10% of the customers would be willing to pay $40. The single-price profit-maximizing strategy is then to charge $10, because 100% x $10 is more than 10% x $40, and no customer benefits because all price discrimination does is allow them to overcharge the remaining 10%. More to the point, in an actually competitive market, price discrimination isn't possible. If the marginal cost of providing the service is $7 and anyone is charging $40 to anyone, someone else could take those customers by charging $39, and someone else could take their customers by charging $25, until the market price is a thin margin over the underlying cost of providing the service. Because even the customers willing to pay $40 would prefer to pay $8, and the company that has 0.25% market share at $40 would rather have 10% market share at $8. The better argument in favor of the "SSO tax" is the one from the comments: That SSO actually increases the cost of providing the service by raising support costs.

noleary 2y ago
I can identify basically three criticisms of my argument in your post. (1) That I assume companies never have market power. (2) That I suppose "market power" implies monopoly (3) That my example was cherry-picked. 1. I did no such thing. I explicitly acknowledged market power several times. 2. Again, not correct. I explicitly mentioned oligopoly (assuming that 'imperfect competition' wouldn't land). 3. Of course it was. I acknowledged as much! I quite literally said the example doesn't generalize. The example serves to illustrate a 'there exists' claim. I felt a concrete example would be easier to follow than some kind of generalized model. Your own comment claims that "actually competitive" markets can't have price discrimination. Sure, we can suppose the law of one price applies to perfectly competitive markets, but there's no sense in which a perfectly competitive markets "actually" exist at all! The obvious observation we can make is that such competitive dynamics imply that no one would make any profit! My appeal to the airline industry as an example was not an accident. There's a very well-established literature on the relationship between competition and discrimination in the airline business. It's *certainly* not a settled question that discrimination decreases as competition intensifies. I included a classic from Stavins below that finds precisely the opposite of your claim. My argument here isn't perfect. I can think of many flaws, many reasonable objections. But I don't think you're using any of them here. ---- Referenced paper from Stavins: https://www.bostonfed.org/publications/research-department-working-paper/1996/price-discrimination-in-the-airline-market-the-effect-of-market-concentration.aspx https://www.bostonfed.org/publications/research-department-w...

johngalt 2y ago

No problem at all with the concept of price discrimination. The economics make sense. In any scenario where unit costs are low, but development costs are high, the ideal situation is where everyone gets the benefit of having the product at a price they are willing to pay. Maximizes total value to all parties. The problem with the SSO tax is that it wedges itself into the pre-existing cracks in most organizations. Security practitioners are already in conflict with other departments. What happens when a department head has pitched a new SaaS as being 1x price, but then it becomes 2x price after the security team's requirements are added? It is not seen as the [application is expensive], it seen as [security team's requirements have doubled the price]. Conversely a price discrimination strategy which locks specific user facing features behind a specific tiers means that the same person championing the software, would also advocate for the appropriate payment tier. Price discrimination is a valid strategy. Responding to organizations who are actively making the security practitioners job more difficult is also valid.

jessriedel 2y ago

> Some of us believe that all parties should pay a fair price, the same price for a given product or service. I have some sympathy for that perspective. I myself have felt tempted to describe certain prices as ripoffs, saying something like “a bottle of water should not cost $8” while waiting to board a flight at SFO. It’s very natural for us to say things like that. Airports are natural, government-administered monopolies, who then typically auction off the rights for firms to sell to a captive audience with little to no competition. This typically results in unfair and wasteful allocation of resources.

phkx 2y ago

I can‘t help to observe that the shapes in the article can be sorted by color and shape, with each resulting stack being numbered from 1 to 4. Problem solved ;)

Woshiwuja 2y ago

Coursera 12400% Increase is CRAZY

abigail95 2y ago

Coming in late to this discussion but I take issue with people framing charging more for features as price discrimination. It's not, it's selling more features for more money.

michaelmrose 2y ago

> We can’t live in a world with zero profit. And who should determine what reasonable profits might be? The society under whose umbrella we operate. > a bottle of water should not cost $8” while waiting to board a flight at SFO. It’s very natural for us to say things like that. The problem is the bottle of water is only worth $8 in part because they keep you from bringing in drinks not because its especially valuable at that time and place. It's the difference between actually creating value and exploiting people out of their money

physicsguy 2y ago

Implementing SSO is a nightmare, particularly if customers want controls on their side. My view is that you should use Cognito (simple) or Auth0 (simple but expensive) and build a self-setup page for it. Then if customers want it, it's on them to deal with configuring. Oh, and push them all to OpenID because it's a lot less hassle than SAML. If you're selling to big businesses (and you generally want to be), they'll pay for it anyway because this sort of security thing falls under various box ticking exercises for ISO certifications.

carus 2y ago

It appears that many of the complaints in this thread are related to the complexities of SAML. I configure, manage, and troubleshoot many SSO configurations in my work but they are all OAuth2/OIDC based and find them really quite simple, easy to understand, and the RFC's a pleasure to read. Has anyone used both SAML and OIDC in their career and could comment on whether I avoided a difficult time in SSO with SAML, or am I just unaware of the difficulties because its what I regularly work with...