Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Single Sign on Sucks

goteleport.com

Post reply on HN
Print view View original

101–110 of 124 posts

Re: Why Single Sign on Sucks

#101

Post by ElFitz »

cletus wrote: post #79

Weird timing. I was just dealing with an issue related to this. I had a work a phone. I restored an image to my personal iPhone and just today tried to sign on to Youtube. It redirected me to the SSO page for my former employer's page. Why? I guessed I'd signed on to my corp Google account on my phone at some point and it remembered. Googling didn't find an easy answer. There was no opt out button (on the login scree…

I just hate it when clients / employers try to get me to use a Google account.

If not careful, set it up once, in one place (ie email), and you’ll get logged into that account for every single Google app on your iPhone.

No, Google, I don’t want to use Google Maps with some random account some client set up for me. I just want to get their emails. Nothing more.

Then, of course, there’s trying to join a Google Meet meeting, and having to play around with the Google account selection.

But the funniest was when I had my own GSuite org, with almost every service turned off.

I’d get redirected to the admin panel, but then switching to the client’s org’s account would redirect to their admin panel, to which I didn’t have access.

And getting back to the initial app (drive or meet), would bring me back into the account linked to my org, thus the admin panel… After a couple times, I ended up systematically opening those links in a private browsing window.

Re: Why Single Sign on Sucks

#102

Post by stormbrew »

adontz wrote: post #58

GitHub's SSO if it's not Enterprise managed accounts sucks. Thus the example is extremely unlucky. Industry standard is that service provider gets identity from identity provider and provisions an account with that identity. So that if I log in to Jira as john.smith@example.com I'll have john.smith@example.com username. What GitHub does is it links enterprise identity to personal account. So I have to log in twice (a…

Honestly, at the risk of committing No True Scotsman, I feel like the flow demonstrated in this blog post just.. isn't SSO to begin with, actually. It may be using SSO infrastructure, but if you have to login twice, use 2fa twice, to log in to one thing, then it's Two Sign On or something.

So while I don't think the thrust of the post is wrong in general, it's an odd example.

> GitHub's justification is that contributions on enterprise projects should be visible on personal accounts.

Really the thing that sucks here is something that hasn't really been well solved and is only tangentially related to SSO: Multiple linked identities under one or more logical accounts. No site does this well, and SSO is an insufficient tool to help - the entire mechanism of identity on the web is working against it.

Re: Why Single Sign on Sucks

#103

Post by number6 »

tootie wrote: post #68
deergomoo wrote: post #3

I feel like this article misses the point that SSO is intended to benefit organisations, not users. The selling point is that if an IT department can point a new service at Active Directory or something, it's going to be much less of a headache than managing n sets of user credentials.

Not just miss the point but isn't also just incorrect? SSO typically doesn't require you to login more than once a day. Unless they explicitly set a policy to expire sessions really fast. If you have Okta/Auth0 or the like in your enterprise it should cookie your session in the identity provider and automatically admit you to anything gated by that identity provider

Yes. I sign on by typing my email address and then... redirect... redirect... signed in. Guess the interface could be nicer but generally it's nice

Re: Why Single Sign on Sucks

#104

Post by XorNot »

vetinari wrote: post #69
XorNot wrote: post #32

This is the problem Kerberos solved. It solved it well. You log on to your workstation, do whatever auth dance, and then that ticket gets used by SSH, your web browser and everything else to seamlessly log you into other services. When it works, it works really well, but absolutely no one implements support for it.

Oh yes, somebody implements it, many certainly heard of Active Directory ;) (or maybe even of FreeIPA). However, it is not really safe to expose it publicly, so it is stuck to intranet only. Random services can ask the user for a ticket (domain does not have to match the realm!), so in your browser you need to whitelist hosts that are allowed to ask for SPNEGO. It does not help that both mobile platforms and macOS in…

There's not really much evidence that Kerberos was ever insecure to expose publicly - this seems to be more heresay then any actual problem.

The biggest problem is the client setup story - and that honestly has more to do with the very inconsistent support in the application space then any real restrictions. It's "enterprisey" and has no story where the user owns their own device (then again so is SSO and Microsoft would like all Windows machines to be joined to the big microsoft.com realm in the sky anyway).

Re: Why Single Sign on Sucks

#105

Post by Too »

hinkley wrote: post #18
deergomoo wrote: post #3

I feel like this article misses the point that SSO is intended to benefit organisations, not users. The selling point is that if an IT department can point a new service at Active Directory or something, it's going to be much less of a headache than managing n sets of user credentials.

I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. On the one hand, Precautionary Principle. The costs of being wrong - and having to explain it to the Board - are just unimaginable. So sure, if you want IT to have a way to push a button and block someone out of the ent…

Hah. If you worry about malicious employees I can tell you that SSO is the opposite of a solution.

Most SSO integrations have very bad Single-Sign-Out design, if any at all. So as long as the token in your session has not expired yet, you have full access to resources, even if account is blocked in the Id Provider.

Re: Why Single Sign on Sucks

#107

Post by Too »

csben wrote: post #4

My experience is completely opposite of the author's. I sign on once a day when I access a service that uses my firm's SSO solution. I'm then automatically signed in to all other services as I use them. It's quite seamless. I have no complaints about the SSO setup in my firm.

Same here. If anyone has different experience you should file a bug on your IT department.

The example from the article looks terrible and should not be seen as representative for how SSO can work.

That said, it’s still not the sign on nirvana we all want to have, browsers and OS still have a lot of areas for improvement here.

Re: Why Single Sign on Sucks

#108

Post by tomjen3 »

bvrmn wrote: post #23

SSO sucks nothing in compare with TOTP-incompatible "please scan QR" mobile auth. With uniq app per service.

Yeah, I don't know how many services say "please enable TFA" and then don't support my yubikey.

AWS takes the cake - you can enable a youbikey, or other TFA, but only one. So I get locked out if my device ever dies.

Post reply on HN