4 ms·

This is a good economics lesson but fails to address the actual issue people have with the SSO tax. It isn't about the concept of price discrimination, but pric

by paxys 2y ago

This is a good economics lesson but fails to address the actual issue people have with the SSO tax. It isn't about the concept of price discrimination, but price discrimination when it comes to security. You can charge extra for convenience features or other value-add features, sure, but the choice of login provider is something that should be table stakes for every person and every organization regardless of how big they are or how much they can pay. An even worse example – plenty of apps gate two-factor auth behind a paid tier as well.

SOLAR_FIELDS 2y ago
Sure, but most SaaS support “SSO at home” in lower tiers via either Google idp or GitHub. So yes you’re locked into those vendors which kind of sucks but it’s not necessarily true that you have to give up security without forking over the “SSO tax”
- mynameisvlad 2y ago
  I mean, no. If they supported BYOSSO then they wouldn’t be, by definition, charging an SSO tax. People are using the term when SSO as a concept is gated behind a paywall.
tptacek 2y ago
There's no moral valence to price discrimination on enterprise security features.
SoftTalker 2y ago
A customer who wants SSO is signaling that they are using this product in their business operations. I.e. they are making money from it. They aren't just learning it, or using it as a hobby. Therefore the product vendor is going to charge the customer at least some approximation of the value the customer is gaining from the product.
- e_y_ 2y ago
  The amount of money and budget that a company has can vary wildly. Just because your company uses SSO doesn't mean you're a Fortune 500. Of course this mostly means that if your required feature set falls into the "Contact us for pricing" tier then you're going to have to talk to a sales rep (probably several, from different vendors so you have a competitive quote) instead of getting any kind transparent pricing.
- aaronfitz 2y ago
  While generally true it's not a perfect signal. I would love to roll out SSO for my family off of my domain but can't because of the SSO tax. I realize power users like me are in the extreme minority
wolrah 2y ago
Exactly my thoughts. IMO it's analogous to SSL/TLS, which for the longest time was something you had to pay extra for at multiple levels. You had to get a dedicated IP for your service instead of being able to use shared hosting, you had to buy the certificate itself, and you had to have someone renew it and install the new certificate every now and then. Even from the user side there were web sites I remember where SSL access as a client was a premium feature as if it had a meaningful cost per use instead of just the cost to have it available at all. This was long lamented in the security-focused parts of the internet but no significant movement happened until late 2010 when the Firesheep extension made sniffing unencrypted passwords or session keys accessible to the masses. Suddenly it wasn't just security nerds complaining about things that could easily be brushed off by higher-ups, it was a problem that anyone who could install a Firefox extension (which thanks to ad blocking and the general badness of could see with their own eyes Almost overnight major services decided that they in fact were fully capable of offering encrypted services to everyone. Suddenly client and server applications, SSL/TLS libraries, etc. that had been ignoring SNI all started supporting it over the next year or two so you didn't need a dedicated IP per hostname anymore. The ISRG was formed and developed Let's Encrypt to solve the problem of having to pay for certs, and while they were at it took the opportunity to develop and enforce the use of ACME with short-lived certificates so automation was effectively mandatory. In six years we went from there being a "SSL/TLS Tax", which every part of the process would defend as absolutely necessary costs, to it being freely available to all and automatically supported by a lot of major application and service platforms. I look at the SSO Tax situation as being mostly comparable from the user side of things. The internet as a whole would benefit from wide support for SSO, but the demand to solve the problem is minimal because most of the people making the purchasing decisions don't care about the problem enough to make it a requirement. There are definitely some valid points that have been made about support costs associated with SSO, especially with regards to supporting more than just a couple of big name identity providers, but I don't think most people would complain if a vendor limited their free/cheap tiers to those couple of big systems those clients are likely already using. If someone needs custom integration they get to pay enterprise prices, but if they just want to sign in with Google that should be accessible to all. The support costs should scale well with a good implementation, hypothetically if Google or Microsoft changes something that breaks your integration you only have to fix it once to solve issues for everyone using it, as opposed to private identity services where each tenant might need something slightly different.

by paxys 2y ago

SOLAR_FIELDS 2y ago

Sure, but most SaaS support “SSO at home” in lower tiers via either Google idp or GitHub. So yes you’re locked into those vendors which kind of sucks but it’s not necessarily true that you have to give up security without forking over the “SSO tax”

mynameisvlad 2y ago
I mean, no. If they supported BYOSSO then they wouldn’t be, by definition, charging an SSO tax. People are using the term when SSO as a concept is gated behind a paywall.

tptacek 2y ago

There's no moral valence to price discrimination on enterprise security features.

SoftTalker 2y ago

A customer who wants SSO is signaling that they are using this product in their business operations. I.e. they are making money from it. They aren't just learning it, or using it as a hobby. Therefore the product vendor is going to charge the customer at least some approximation of the value the customer is gaining from the product.

e_y_ 2y ago
The amount of money and budget that a company has can vary wildly. Just because your company uses SSO doesn't mean you're a Fortune 500. Of course this mostly means that if your required feature set falls into the "Contact us for pricing" tier then you're going to have to talk to a sales rep (probably several, from different vendors so you have a competitive quote) instead of getting any kind transparent pricing.
aaronfitz 2y ago
While generally true it's not a perfect signal. I would love to roll out SSO for my family off of my domain but can't because of the SSO tax. I realize power users like me are in the extreme minority

wolrah 2y ago

Exactly my thoughts. IMO it's analogous to SSL/TLS, which for the longest time was something you had to pay extra for at multiple levels. You had to get a dedicated IP for your service instead of being able to use shared hosting, you had to buy the certificate itself, and you had to have someone renew it and install the new certificate every now and then. Even from the user side there were web sites I remember where SSL access as a client was a premium feature as if it had a meaningful cost per use instead of just the cost to have it available at all. This was long lamented in the security-focused parts of the internet but no significant movement happened until late 2010 when the Firesheep extension made sniffing unencrypted passwords or session keys accessible to the masses. Suddenly it wasn't just security nerds complaining about things that could easily be brushed off by higher-ups, it was a problem that anyone who could install a Firefox extension (which thanks to ad blocking and the general badness of could see with their own eyes Almost overnight major services decided that they in fact were fully capable of offering encrypted services to everyone. Suddenly client and server applications, SSL/TLS libraries, etc. that had been ignoring SNI all started supporting it over the next year or two so you didn't need a dedicated IP per hostname anymore. The ISRG was formed and developed Let's Encrypt to solve the problem of having to pay for certs, and while they were at it took the opportunity to develop and enforce the use of ACME with short-lived certificates so automation was effectively mandatory. In six years we went from there being a "SSL/TLS Tax", which every part of the process would defend as absolutely necessary costs, to it being freely available to all and automatically supported by a lot of major application and service platforms. I look at the SSO Tax situation as being mostly comparable from the user side of things. The internet as a whole would benefit from wide support for SSO, but the demand to solve the problem is minimal because most of the people making the purchasing decisions don't care about the problem enough to make it a requirement. There are definitely some valid points that have been made about support costs associated with SSO, especially with regards to supporting more than just a couple of big name identity providers, but I don't think most people would complain if a vendor limited their free/cheap tiers to those couple of big systems those clients are likely already using. If someone needs custom integration they get to pay enterprise prices, but if they just want to sign in with Google that should be accessible to all. The support costs should scale well with a good implementation, hypothetically if Google or Microsoft changes something that breaks your integration you only have to fix it once to solve issues for everyone using it, as opposed to private identity services where each tenant might need something slightly different.