171–180 of 297 posts
I know the third party SSO services are recommended but .. I still have a hankering after the old, run it yourself approaches.
Am I missing something?
Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access.
And speaking of a single point of failure, cloud password managers look even worse[1].
[1]: https://thehackernews.com/2023/02/lastpass-reveals-second-at...
Earlier quoted context omitted.
My last company settled on LastPass before they gave away all your passwords.
Well, the subject was about how to share passwords. LastPass is astoundingly good at that part.
People overwhelmingly recommend SSO. Isn’t that lowering the security level? If that single account gets taken over, the attacker has access everywhere else too. Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access. And speaking of a single point of failure, cloud password managers look even worse[1]. [1]: https://thehackernews.com/2023/02/lastpass-…
People overwhelmingly recommend SSO. Isn’t that lowering the security level? If that single account gets taken over, the attacker has access everywhere else too. Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access. And speaking of a single point of failure, cloud password managers look even worse[1]. [1]: https://thehackernews.com/2023/02/lastpass-…
If everyone did authentication well, then centralized IDPs might be questionable from a computer security perspective. But most aren't doing it well.
On top of that, humans generally work best if they don't have to remember lots of truly random passwords. I.e. in realistic settings, there's a maximum of expected passwords either way. And the true gain of having dedicated auth everywhere is minor.
There's some consideration for things like FIDO/WebAuthn/PassKeys, but they mostly just shift the issue from a single provider in cloud, to a single (hardware) token. Harder to copy than browser cookies, but still a single point unless it's combined with MFA.
People overwhelmingly recommend SSO. Isn’t that lowering the security level? If that single account gets taken over, the attacker has access everywhere else too. Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access. And speaking of a single point of failure, cloud password managers look even worse[1]. [1]: https://thehackernews.com/2023/02/lastpass-…
But it’s generally a well-secured one (2fa, ip monitoring ). So in effect we’re not making it more of a single point of failure, we’re just removing the various other means of attack by removing site-specific identities (passwords)
People overwhelmingly recommend SSO. Isn’t that lowering the security level? If that single account gets taken over, the attacker has access everywhere else too. Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access. And speaking of a single point of failure, cloud password managers look even worse[1]. [1]: https://thehackernews.com/2023/02/lastpass-…
For example, where the authentication request is coming from (on-site, managed device), what methods are being used (hardware second factor, Authenticator app).
These are all things that the SSO can check at time of authentication, before a token or session key gets issued to the user. Also, all of these things can be checked again when doing any auth flows for the various linked services.
So with stolen SSO credentials, they might be worth diddly squat to you if you didn’t think to also be on-site or on a managed company device (physically or virtually).
- Use 1Password or similar password vault to deliver account passwords on day one; the password manager also promotes good personal password management practices - only share passwords for personal accounts; those accounts you terminate when the employee separates. For shared resources, use SSO and SCIM group management via the SSO provider to add and remove accounts from groups with different roles. Rippling seems l…
OOI do you ever use SCIM for something really granular? I have a service where people can be one of 5 roles and then have access to 1..30 named 'workspaces' - all that we'd like to control with policy on our side not vendor side I think it's unsuitable for SCIM because I'd have to create 5*30 AD groups?
Of course, if there’s a way to simplify the access (like are there truly 5 roles or in practice do people end up bucketed in to 2/3), or if you can configure one role group with the user is always in and group per workspace that’s always ideal, but that might well come back to bite you.