Hacker News Reader

Comment by MichaelGG | Hacker News Reader

Because you're unlikey to trigger a violation on your cloud SaaS account, but could easily run afoul of other policies like "Real Name" or "Bought a Pixel Phone and Sold It" or posting something "offensive", getting reported by other users, etc.

If the account is just for a cloud SaaS, then there's likely to be very few policies to disable your account.

View on HN

But then you're storing passwords in more services, which creates more surface area for breaches.

If you shop with Amazon, host your services with Amazon, watch TV on Amazon...there's simply no way of getting around the fact that Amazon will only want to manage a password for you in one place. The issue is clearly over reliance on Amazon services.

I don't follow your logic about the breach risk. If you're using unique passwords per service (and you really should) then I would expect any breach that involved passwords would have less of an effect. If there is a breach with a centralized single sign on service then every other dependent service is also affected.

There's a big difference between what people should do, and what people actually do. Research consistently shows that a large percentage of people reuse passwords across many sites.

[1] http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf

Sure, but I'd bet that people who have cloud services accounts are much more likely to be better at password security than the general public, as a group.

Create multiple accounts then

Yeah, it's convenient to have only one, but it seems it's dangerous as well

Uh, Sure, if you have one account. The point being that if you're smart, you isolate every account. myaccount-aws@domain and myaccount-retail@domain and then turn off cloud services for retail account and turn on two factor auth for saas.

That's on you. You can't get the benifit of separation if you have them do it for you.

In the same way you get one company to own your domain and one to run your email. That way when your email provider decides you're a spammer or your account get's closed for uploading a bad app to the android store, you can go else where and swap your dns.

Reply on news.ycombinator.com