An admittedly wandering defense of the SSO tax

Not really. Especially if both systems are already in place and they just need to turn it on.

The swipe system should be a very minor or zero part of the rent, not double.

>>In short: SSO is a core security requirement for any company with more than five employees.

This is from a random website with no credentials that makes no arguments to back up its claim. It's meaningless.

>>Imagine buying a car and the manufacturer asks for an extra payment to unlock 100% of the braking power.

And this is a fatally flawed analogy that renders it useless. The situations of "hardware shipped that can't be unlocked until user pays" and "paying additional to support a feature that takes a lot of effort to develop, and actively takes more effort from the vendor to support" aren't remotely comparable.

Neither of these quotes support this position.

> The point is that "only large enterprises need or care about SSO" is completely wrong-headed and detrimental to the overall security posture of any business customer.

As to this - is there any actual empirical evidence that missing SSO meaningfully weakens security for small businesses, which are the ones that would actually care about forking over the extra for the enterprise tier? That doesn't sound very believable to me - small businesses are both disproportionately smaller targets, and also have much less complex IT systems with fewer logins to manage. I find it unlikely that missing SSO matters that much from them, and I'd like to see empirical evidence otherwise.

Also, there's nothing wrong for charging different amounts for different levels of security, assuming that that cost translates into actual effort (which it does for SSO). Normal people pay small amounts of money for physical door locks that are woefully insecure - the proposition that lock manufacturers should make their industrial and home locks cost the same would be pretty ludicrous.

> Not really. Especially if both systems are already in place and they just need to turn it on.

This isn't a valid analogy to SSO. SSO doesn't just cost extra to develop (which in itself is a valid reason for charging more), but it costs extra to maintain - you can find several other comments in this thread alone talking about how difficult it is to support SSO from a technical/customer service perspective. People are expensive - both when writing code, and when supporting it.

This argument is basically wrong because it supposes companies don't have market power when they do. "Market power" doesn't mean monopoly. It takes at least four and more often at least a dozen viable competitors before you have enough that there isn't an implicit cartel, and there are altogether too many markets where this is the case.

Nearly all specialty or line of business software, for example. These markets commonly have two or three providers and rarely have hundreds. Literally the intended purpose of copyright in this context is to give the authors market power.

And then the example given is the sympathetic one. The premise here is that there are the same number of customers willing to pay $40 as $10, and so the rational choice for a company not engaged in price discrimination is to charge $40 to everyone and price discrimination allows them to provide a "discount" to half of the customers.

Now suppose that only 10% of the customers would be willing to pay $40. The single-price profit-maximizing strategy is then to charge $10, because 100% x $10 is more than 10% x $40, and no customer benefits because all price discrimination does is allow them to overcharge the remaining 10%.

More to the point, in an actually competitive market, price discrimination isn't possible. If the marginal cost of providing the service is $7 and anyone is charging $40 to anyone, someone else could take those customers by charging $39, and someone else could take their customers by charging $25, until the market price is a thin margin over the underlying cost of providing the service. Because even the customers willing to pay $40 would prefer to pay $8, and the company that has 0.25% market share at $40 would rather have 10% market share at $8.

The better argument in favor of the "SSO tax" is the one from the comments: That SSO actually increases the cost of providing the service by raising support costs.

As I pointed out in a sibling thread, most SaaS offer “SSO at home” eg oauth2/oidc via either Google idp or GitHub in lower tiers, often in free tiers. So to get “adequate security” you don’t necessarily have to pay the SSO tax, but your alternative is that you must be locked to one of those two vendors, which is of course not ideal at all. But to say you have to pay the SSO tax to get “adequate security” is not really true at face value because of this.

That being said, obviously this situation as described sucks and we should not move towards it because really all it does is push SaaS startups towards these two vendors to punt huge licensing fees down the road until they have the revenue to support it. And by then they are significantly locked in to these specific two vendors, two vendors that already have problematic approaches to monopolizing certain things. So fixing this is important but for a different reason than one might take at face value.