This pops up on HN about once a year, and it's worth calling out that the SSO tax has mostly nothing to do with technology or with support costs and mostly everything to do with market segmentation. One of the clearest segmentation signals you get is that bigger, less price-sensitive customers all require SSO (because their SOC2 attestations require it).

You can get irritated about pricing systems that soak price-insensitive customers, but remember that the big price-insensitive customers pay for the price-sensitive customers, which is why this kind of segmentation is practically universal.

Previously, on this, from me:

https://news.ycombinator.com/item?id=29892664

> but remember that the big price-insensitive customers pay for the price-sensitive customers

The fallacy is thinking that the alternative is for everyone to pay the lower price and get the enterprise features.

In reality, without market segmentation a singular price for everyone would fall much closer to the enterprise price than the non-enterprise price.

You can call it an SSO tax, but it would be equally correct to refer to the lower price as the non-corporate discount.

I like Patio11's characterization[0]:

> The right way to think of the "SSO tax" (where companies charge extra for security features) is "You are being offered a dual use product backed by a strong engineering team for far less than it would otherwise cost, with sophisticated enterprises picking up the slack."

That said, TLS/SSL used to be the preserve of the enterprise too (or at least the ecommerce site).

There are lots of free options, including 3rd party servers and libraries. I'm hoping eventually SSO will be, if not in free versions, at least not isolated to enterprise plans.

0: https://x.com/patio11/status/1481293027331440640

> and it's worth calling out that the SSO tax has mostly nothing to do with technology or with support costs

I'm surprised this is at the top. My experience, and the experience of nearly all the commenters below, is that SSO is by far the biggest support burden they have.

SSO costs extra because it costs extra to support them. Market segmentation is a nice side effect though.

> mostly nothing to do with technology or with support costs

Support costs aren't zero though. I work for a company with a lot of corporate customers and we get loads of SSO support tickets. People are always misreading the docs, (mis)configuring things against our recommendations, migrating systems, merging systems (due to acquisition etc)...

Also, enterprise customers are way more work, the sales cycle is longer, the compliance and onboarding stuff takes more time. There's a very legitimate case for building that into one's pricing, and it's really the same reason these companies appear price insensitive. If they had people lining up to give them a better price, they'd presumably take it.

I run a very small business, SSO is still very high up on my feature priority list, and I have passed on software/services I would have otherwise used for competitors that offered SSO at a lower entry-point.

Can you clarify, are you suggesting that the bills footed by large orgs that require SSO are paying the bills for these features?

I don't think SOC2 specifically demands SSO and just encourages it. Probably good, since such security mandates often age badly, even such a broad concept like SSO could fall victim. And there is always that one tool that isn't integrated, ironically inhouse software often neglects it.

But otherwise I believe you are very on point. Although from a developer perspective perhaps it should be segmented the other way around. If I can outsource to identity providers, I have delegated a lot of risk and work. And while the initial implementation might be a bit more cumbersome, in the long run it certainly is less development intensive than providing a complete user management interface. And maintenance for a few keys is easier than user management, even if you still have to do some of that.

Perhaps not using SSO should be marketed as some privacy focused benefit, which is more expensive.

Security is an optional feature? You must be a sales executive...

Thank you for adding some sanity to this discussion – this is ultimately a matter of economics, and the R&D effort to add and maintain these features is not trivial.

So the price insensitive get the security the price sensitive can’t afford.

That’s the same logic some use to explain why university fees have to exist opposed to being tax funded, because otherwise the poorer would finance the education of the wealthy totally ignoring that higher costs are the barrier that makes less likely that the poorer can study in the first place.

shouldn't every new company be using SSO for everything in 2025 and beyond? how long before this no longer becomes a good signal?

> but remember that the big price-insensitive customers pay for the price-sensitive customers

You mean they more than make up for the loss of those customers? What is the underlying cost on the service? Isn't the profit margin here absolutely absurd since the underlying cost to the vendor is basically zero once their implementation is written?

I hate this argument. The local PTA or kids sports league or boutique needs sso as much or more than an enterprise. These may be organizations without an IT department at all, handed down from family to family, where they are transferring a database of gmail passwords. I know gsuite and office365 have free tiers for charity, but the amount of small businesses with a gmail address is staggering.

SSO should be a feature for the family as well. A parent should be able to pull up a dashboard and see where all their family gmail accounts are authorized to use as a login from one screen without scrolling.

The overall sentiment that SSO creates a support burden is true, but a separate problem that should also be fixed. it _shouldnt_ be complicated for a small team with ten accounts to control group login information, revoke access, lock accounts.

Yes - it's an enterprise versus SMB distinction that doesn't require asking questions like "What's your revenue?" in the qualification. Enterprises need it. SMBs don't.

I’d take it a step further and say it helps the customer filter vendors too small to be worth the trouble.

At work, I can’t afford free.

Similar reason why there is a big price difference between DVDs and Blu-rays, and why DVDs still exist in the first place.

This is how I've come to accept it too

And honestly when I really really want SSO anyways, I can bolt on vouch proxy for free

What are your normative views on this topic?

I think this is overly complimentary to big business and what's essentially predatory pricing.

The reality is you can't just carve out on feature and say "we pay for this." I mean that's true of a lot of things. The big revenue generators pay for a lot of things, but how things are billed is important. Remember, not to long ago people paid for Netscape, but now its laughable to pay for a browser. Its arbitrary to have this 'buffet' mentality and seems purposely shaming towards people who rightfully complain about ridiculous pricing structures like this.

I'm also skeptical that SSO costs vendors money. Maintaining and supporting an authentication database is a huge expense. For every SSO client, its one less Adobe or whatever account that needs to be hosted. Less helpdesk tickets about password resets, etc. SSO tends to be once and done. Hosting millions of accounts and being the sign-on provider for them is not 'once and done.'

Lastly, a lot of orgs don't do this. A lot arent SOC2. That means they'll just use whatever account the vendor supplies, and most likely without MFA, but their SSO would have provided that, thus making everyone more vulnerable. This is a great example of how exec salaries and stock buybacks and other things have priority over security because security is seen as a cost-center and without litigation or law, stuff like this becomes the norm. Oh and now there's one more source of passwords out there and another potential hack.

This is just greed and predatory. Its not the wonderful largess of big companies. It fact, its quite the opposite.

Small orgs don't need to be SOC2 to have client contracts that require SSO. This is absolute fucking evil behavior and this page shouldn't exist anymore in 2025.