Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Single Sign on Sucks

goteleport.com

Post reply on HN
Print view View original

41–50 of 124 posts

Re: Why Single Sign on Sucks

#41

Post by seanp2k2 »

Spivak wrote: post #17
throwawayboise wrote: post #10

Earlier quoted context omitted.

So your company doesn't have certain functions where someone has said "this is really critical so we'll force a sign-in even if the SSO token is already there" because that happens to me 10 times a day at my work.

Which is silly because if you do that you're basically admitting that your SSO isn't fulfilling its promise of identifying the user. If you are having the thought, "what if the user I authed isn't the user anymore" then you should be reauthing them for any service at that point.

Almost as fun as when TSA uses logic like “we thought you were going to hijack a plane using those nail clippers, but now that we’ve made you throw them away, you can board with no further scrutiny! Crisis averted!”

Re: Why Single Sign on Sucks

#42

Post by [deleted] »

IncRnd wrote: post #34
hinkley wrote: post #18

Earlier quoted context omitted.

I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. On the one hand, Precautionary Principle. The costs of being wrong - and having to explain it to the Board - are just unimaginable. So sure, if you want IT to have a way to push a button and block someone out of the ent…

> I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. Because employers see how some employees act as they depart, even though they don't act similarly around their coworkers. Employers also see trusted employees smile and leave for competitors even after signing that th…

[deleted]

Re: Why Single Sign on Sucks

#43

Post by gkop »

Aeolun wrote: post #36
gkop wrote: post #12

Article does a decent job of calling out some usability issues with SSO, but doesn't investigate the impact of these usability issues on security. Security and usability are often in tension - if we're going to improve usability, our proposed changes also need to improve security, or they're dead on arrival. (which is incidentally how we got to this place of horrendous usability) Indeed, there are some material secur…

My pet peeve is having to change my password every 3 months. I can practically guarantee all the employees use some form of incrementing number.

Don't get me started...

Re: Why Single Sign on Sucks

#44

Post by feoren »

IncRnd wrote: post #34
hinkley wrote: post #18

Earlier quoted context omitted.

I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. On the one hand, Precautionary Principle. The costs of being wrong - and having to explain it to the Board - are just unimaginable. So sure, if you want IT to have a way to push a button and block someone out of the ent…

> I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. Because employers see how some employees act as they depart, even though they don't act similarly around their coworkers. Employers also see trusted employees smile and leave for competitors even after signing that th…

> Employers also see trusted employees smile and leave for competitors even after signing that they would not do that.

Employers who ask their employees to sign immoral and usually illegal non-compete clauses deserve whatever they get, honestly. Employers should expect their employees to go work for competitors when they leave. Where else are they going to go work, but companies with similar operations? An ecology management company fires and ecologist and they clutch their pearls when that ecologist goes and works for another ecology management company, instead of McDonalds!? Gasp! The nerve of that person!

Don't want your employees to go work for a competitor? Don't treat them like shit.

Re: Why Single Sign on Sucks

#45

Post by ghaff »

Johnny555 wrote: post #25
hinkley wrote: post #18

Earlier quoted context omitted.

I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. On the one hand, Precautionary Principle. The costs of being wrong - and having to explain it to the Board - are just unimaginable. So sure, if you want IT to have a way to push a button and block someone out of the ent…

I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. Proper offboarding protects you too, not just the company. If you leave the company and someone compromises one of the 27 hard-coded credentials left behind on various machines and services, then it puts you under suspi…

Yep. It's like sharing passwords to important personal accounts more generally. Sure, the main reason you don't is that stuff can happen in relationships and people can end up doing things you didn't think they would. But a secondary reason that if something does happen in an account that you've shared a password with someone, it's hard not to have at least a glimmer of suspicion.

Re: Why Single Sign on Sucks

#46

Post by derekp7 »

throwawayboise wrote: post #10
csben wrote: post #4

My experience is completely opposite of the author's. I sign on once a day when I access a service that uses my firm's SSO solution. I'm then automatically signed in to all other services as I use them. It's quite seamless. I have no complaints about the SSO setup in my firm.

So your company doesn't have certain functions where someone has said "this is really critical so we'll force a sign-in even if the SSO token is already there" because that happens to me 10 times a day at my work.

I see this in situations similar to sudo where you need to make sure it is the same user that signed on when elevating privileges, vs letting in anyone who sits down at an unlocked user's terminal.

Re: Why Single Sign on Sucks

#47

Post by pyrale »

gkop wrote: post #35
pyrale wrote: post #30

Earlier quoted context omitted.

At some point, your user also has right to make their own policies. Imagine your banker requiring you to take a drug test before they let you do any action, would that be fine by you? If you were talking about your employees, of course, it's less of an issues, but you are still open to them misusing other solutions: in the end, invasive security policies in a business where people can also use service accounts is a r…

I'm not following you but very curious! I have no issues getting my enterprise customers to configure SSO, so there's no practical reason for me to support password login. In the consumer space, which is not my area of expertise, it seems that combinations of "passwordless" and OAuth are working for successful companies. Where is the last bastion of places where a user can justifiably demand a password login option?…

(I made some edits to the previous post, as I figured out you may have talked about people working with you rather than clients)

> I have no issues getting my enterprise customers to configure SSO, so there's no practical reason for me to support password login.

I'm not really sure what you mean when you say SSO. We use Google workspace at work, and use the sso in several of our products. Still, since workspace admin prompts us to relog every damn time, some colleagues use the service account to perform workspace actions. That's a hole of course, as the service account is not supposed to be used for user actions, but it's also more convenient.

Another example, of which I'm guilty, was my previous work's VPN 2FA policy, which my team conveniently skipped with a script doing the oauth call. Of course, not everyone did the script properly (because prompting for your password takes a couple more lines), and so some of us may have had their credentials in the bash file.

This kind of shortcuts is hard to avoid for technical users, and so the golden rule for security in my opinion is that it should be easier to do the right thing. Unfortunately, each person has a different definition of friction, so it's not an easy topic.

> What do you mean by invasive security practices?

It's obviously a personal criterion. To me, invasive starts when people want to get in my phone. It's not really arbitrary, since my phone is a piece of garbage that has no security, but it's a personal thing since others may prefer to have a phone solution.

Re: Why Single Sign on Sucks

#48

Post by toastal »

Aeolun wrote: post #33
deergomoo wrote: post #3

I feel like this article misses the point that SSO is intended to benefit organisations, not users. The selling point is that if an IT department can point a new service at Active Directory or something, it's going to be much less of a headache than managing n sets of user credentials.

No, SSO also helps me. Having only one password to change is really nice. It’s the SSO process that annoys me. Between all the redirects and duplicate information, signin takes 4 times longer than user/password auth.

It would also help an adversary that only needs to know your one password.

Re: Why Single Sign on Sucks

#49

Post by seanp2k2 »

Aeolun wrote: post #36
gkop wrote: post #12

Article does a decent job of calling out some usability issues with SSO, but doesn't investigate the impact of these usability issues on security. Security and usability are often in tension - if we're going to improve usability, our proposed changes also need to improve security, or they're dead on arrival. (which is incidentally how we got to this place of horrendous usability) Indeed, there are some material secur…

My pet peeve is having to change my password every 3 months. I can practically guarantee all the employees use some form of incrementing number.

1. Try passwords until you get locked out

2. Engage with IT to unlock

3. Reset password flow

4. Iterate on new password as the complexity requirements you fail are slowly revealed to you

5. “Password cannot be the same as previous n passwords”

6. End up with an even more forgettable variation

7. Sign in again across all your now-invalid sessions across a dozen apps and devices.

8. Apply liberal amounts of 2FA + push-based and email or txt confirmations to the above for extra hate from users.

9. Repeat forever because obviously there is no better way to do this, but GraphQL and NFTs are going to save the world, let’s work on those instead!

Re: Why Single Sign on Sucks

#50

Post by IncRnd »

feoren wrote: post #44
IncRnd wrote: post #34

Earlier quoted context omitted.

> I can think of two times in my life where I even considered the possibility that one of my peers would do something malicious on their way out the door, but management worries about this all the time. Because employers see how some employees act as they depart, even though they don't act similarly around their coworkers. Employers also see trusted employees smile and leave for competitors even after signing that th…

> Employers also see trusted employees smile and leave for competitors even after signing that they would not do that. Employers who ask their employees to sign immoral and usually illegal non-compete clauses deserve whatever they get, honestly. Employers should expect their employees to go work for competitors when they leave. Where else are they going to go work, but companies with similar operations? An ecology ma…

> Employers who ask their employees to sign immoral and usually illegal non-compete clauses deserve whatever they get, honestly. Employers should expect their employees to go work for competitors when they leave.

That's my point as to why employers want to immediately stop access to employees who leave for competitors.

> An ecology management company fires and ecologist and they clutch their pearls when that ecologist goes and works for another ecology management company, instead of McDonalds!?

You can word it that way, but what can and does happen is that employees leave and steal confidential processes or information to boost their own value at a competitor. Many people agree with you, until they start their own company and theft happens to them, draining their work straight to a competitor.

Post reply on HN