As I pointed out in a sibling thread, most SaaS offer “SSO at home” eg oauth2/oidc via either Google idp or GitHub in lower tiers, often in free tiers. So to ge

As I pointed out in a sibling thread, most SaaS offer “SSO at home” eg oauth2/oidc via either Google idp or GitHub in lower tiers, often in free tiers. So to get “adequate security” you don’t necessarily have to pay the SSO tax, but your alternative is that you must be locked to one of those two vendors, which is of course not ideal at all. But to say you have to pay the SSO tax to get “adequate security” is not really true at face value because of this. That being said, obviously this situation as described sucks and we should not move towards it because really all it does is push SaaS startups towards these two vendors to punt huge licensing fees down the road until they have the revenue to support it. And by then they are significantly locked in to these specific two vendors, two vendors that already have problematic approaches to monopolizing certain things. So fixing this is important but for a different reason than one might take at face value.