People overwhelmingly recommend SSO. Isn’t that lowering the security level? If that single account gets taken over, the attacker has access everywhere else too. Some places let you configure SSO+2FA, which helps; but in most cases clicking a social login button gets you full access. And speaking of a single point of failure, cloud password managers look even worse[1]. [1]: https://thehackernews.com/2023/02/lastpass-…
SSO + 2FA is more secure in practice than letting people create/manage their own accounts at every service. Because: - You can force a password policy centrally (minimum 12 char + uppercase/lowercase + number etc), for every service the company is using that supports SSO. - You can force 2FA, again for every service the company is using that supports SSO. - You can disable an account immediately from the central admi…
I have to argue the second part of this though
> minimum 12 char + uppercase/lowercase + number
The first minimum char counts rule is great. You increase the entropy exponentially with every added char.
But the second part when you make rules about each individual char, then you are actually decreasing entropy. The space of possibilities actually shrinks every time a rule defines what a char must or mustn't be. An attacker now knows that certain things are guaranteed, and can tune their brute force algorithm to expect a big ascii letter, a large ascii letter, a latin number, an ascii special char. They now have a much smaller search space than before, when each char could be any utf8 char. You're basically leaking exploitable information about the password by having character rules.