> Single sign-on (SSO) is a mechanism for outsourcing the authentication for your website (or other product) to a third party identity provider, such as Google, Okta, Entra ID (Azure AD), PingFederate, etc.

Or the IdP is administered by the enterprise's own IT operation.

The outsourcing of your security to (and also consequently leaking information to) a third party IdP is a fairly new phenomenon in 'security'.

Someone must have paid a lot of money to promote that idea.

▲

weitendorf 2 days ago | parent | next [-]

Why? It is a screaming good deal for >90% of companies to take as many problems like “employee credentials can be used to access user passwords”, “we need to develop, release, operate, and support something where small mistakes introduce security breaches + hire people capable of property doing that work”, and “if someone gets this private key they can use it to impersonate any user” off their plates as they can.

It’s good that Bob’s App Factory cares enough about security to hand off hard parts to Google for $X/mo if they’re not confident in their own ability to handle it better themselves. I trust Google more with my data than any other company in the world, including Bob’s. Bob’s a great guy but I doubt his IT department is reviewing every change in keycloak and preventing unilateral access to hmac keys.

	▲	neilv 2 days ago \| parent [-]
		Agreed that sometimes it makes sense to outsource, if Bob's App Factory is big and complex enough to actually need SSO, but isn't big enough to want to run it themselves. (I was thinking more F500, which is what I did a lot of SSO work for.) But if you are a larger company who is outsourcing security, then you're subject to enterprise sales and vendors (Google excepted) who might be ridiculously incompetent. (Even if you have people on staff qualified to vet vendors of infrastructure, now you're in SaaS enterprise sales territory, where decisions aren't always rational or informed.) And you're also looking at lots-of-eggs-in-one-basket centralized single point of failure for swaths of the country, which is a more attractive target than Bob's App Factory alone. Example related infrastructure: https://en.wikipedia.org/wiki/SolarWinds#2019%E2%80%932020_s...

▲

lmm 2 days ago | parent | prev | next [-]

> Someone must have paid a lot of money to promote that idea.

I doubt it. Once you notice how bad the median enterprise IT operation is at running an IdP the idea promotes itself.

▲

axus 2 days ago | parent | prev | next [-]

But I really like checking my email without signing in to a VPN.

	▲	neilv 2 days ago \| parent [-]
		An IdP doesn't have to be on a VPN, no matter who operates it.

▲

imtringued 2 days ago | parent | prev [-]

I don't understand the problem. The incentives seem to be aligned.

The IdP company makes money off their security product. This means they are more likely to invest into security, because it's their business that is at stake.

Meanwhile the average company doesn't make money off a secure authentication flow. They make money from selling their SaaS product. Their goal is to spend as little on security as possible.