61–70 of 74 posts
> The average employee likely has 10-20 (hopefully) different sets of credentials that they must maintain and update as necessary That's your red flag right there. All identities that are tied to individual people should be connected to SSO in some way, then there will be no juggling of passwords at all on the individual-person level. Then you only need some 2FA solution on top in your identity provider, for instance…
Earlier quoted context omitted.
> BUT throw $1000/month on the direction of the FOSS developers until the issues are mitigated and they satisfy your requirements This is not at all an easy thing to guarantee even if you’re willing to spend the money. The FOSS developers might not be interested in doing this work (even for pay) nor have UX staff.
Do you have any idea how much "developer power" you can buy with $1000/month, if you just look in the right places? So many talented people working for that money or less in São Paulo, Buenos Aires or Hanoi, it would be worth it to give it a shot even if they just worked part-time.
> The average employee likely has 10-20 (hopefully) different sets of credentials that they must maintain and update as necessary That's your red flag right there. All identities that are tied to individual people should be connected to SSO in some way, then there will be no juggling of passwords at all on the individual-person level. Then you only need some 2FA solution on top in your identity provider, for instance…
this is somewhat a pipedream orgs should support what people do
If you think I'm being hyperbolic, I'm not. Our org has recently gone through a PCI/DSS audit, and there was a lot of frustration about the amount of required changes with regards to locking down access policies, tracking suspicious activity, enforcing 2FA and such, but most of the stuff that I saw change was stuff that feels like it really should be entirely obligatory in the first place.
There is a great tradition in IT to teach yourselves using free (as well as free-of-charge) software, but when you're in the business of IT, there should be much stricter regulation. If you're a civil engineer and the bridge you design collapses because you did your math wrong, you are criminally liable for the damage. But if you're a software "architect" and you negligently put an instance of database-du-jour on the internet without proper access controls or a vulnerability tracking process, you most often get away by just saying "whoopsie-daisy" and giving a flimsy apology to the millions of customers that had their personal data stolen. Worst case scenario, you get a fee of a few percent of your earnings. That has to end.
> The average employee likely has 10-20 (hopefully) different sets of credentials that they must maintain and update as necessary That's your red flag right there. All identities that are tied to individual people should be connected to SSO in some way, then there will be no juggling of passwords at all on the individual-person level. Then you only need some 2FA solution on top in your identity provider, for instance…
Not all SaaS apps support SSO. We use 1password for those that don't.
Earlier quoted context omitted.
Do you have any idea how much "developer power" you can buy with $1000/month, if you just look in the right places? So many talented people working for that money or less in São Paulo, Buenos Aires or Hanoi, it would be worth it to give it a shot even if they just worked part-time.
Right, but then you need to trust them to maintain a fork of vaultwarden or hope that vaultwarden accepts their patches.
In all three cases, though, it sends a signal that there is demand for the changes. This works as both validation for the developers (our users wants this so much they are paying someone else to do it) and also for other companies (oh, why should we be paying this much to a closed-source service if we can pay a fraction of the price to get a reasonably-well-supported open source version?)
LastPass is great. We can share credentials and secrets through it. There's a feature where you can even share the login to a site on it, but they can't view the password - only lastpass can fill it up.
LastPass is terrible if you want to use it for automation. There is no official support for the CLI interface (it's a community project), and it does not work on Windows by default (you'd need to install cygwin on every single server you wish to use the CLI, as opposed to a simple `winget install --name LastPass.CLI`). I cannot recommend that anyone use this product for enterprise use, especially for internal IT use.
> gets very pricey with 10k users With that many users you don't pay the advertised prices. You schedule a call and they make sure you get an affordable offer. > The average employee likely has 10-20 (hopefully) different sets of credentials that they must maintain and update as necessary Time for azure, auth0, okta, or some other sso provider to just get rid of the passwords?
I'm really not cut out to work for a big corporation. Even if they charged $0.50/per user, that would be $5k/month. I could go as a consultant and charge half of that to setup vaultwarden integrated with their AD for maybe 2 lazy days, and offer a support contract for $500/month. It's not even that much of rare skill. I'd guess you can randomly selected /r/selfhosted users and I'd give 10% of odds to find someone who…
You're saying $500/mth, but my response would be: this is half a full time IT support position and it needs a secondary + on-call cover.
Earlier quoted context omitted.
I'm really not cut out to work for a big corporation. Even if they charged $0.50/per user, that would be $5k/month. I could go as a consultant and charge half of that to setup vaultwarden integrated with their AD for maybe 2 lazy days, and offer a support contract for $500/month. It's not even that much of rare skill. I'd guess you can randomly selected /r/selfhosted users and I'd give 10% of odds to find someone who…
While I don't disagree with the gist of your idea (it can be cheaper in-house), I believe you're underestimating the ongoing support cost. At 10k users, it will become a part time support position to manage the solution, handle credential resets, write and update documentation, handle all client side problems, maintain ongoing ad / account integration and browser plugins, deal with any security certification required…