Hacker News Reader

It is outrageous and irresponsible to charge for MFA.

It show a cavalier attitude toward the greater security of the internet.

Same for OIDC (and even traditional SAML SSO).

If every stolen or potentially stolen credential was billed to the breached provider at even $100/account*, SSO would become free so fast your head would spin.

Every credential in the provider's DB would be correctly seen as a liability.

* Arguably the number should be higher and contribute to a infosec response, detection, and preventative measures warchest. Though, ultimately, this would probably just enrich cybersecurity insurance firms.

Agreed.

Another example is Microsoft charging extra for enhanced logging. This came to light during the SolarWinds debacle.

Not exactly the same but this reeks of https://sso.tax.

Why did you purchase a domain on GoDaddy if you know better?