willow9886

Finally! That logo was totally offensive, and I'm not even Native American!

> They’ve been fumbling left and right trying to figure out how to make Medium sustainable, and I’m just not convinced they’ll always do what’s best for us and our business.

This is the risk of becoming dependent on any outside service or company for your critical business activities.

SaaS services make your life easier... until they stop working the way you want, go out of business, get acquired and shuttered, etc. etc.

Pick and choose wisely. And always have a backup plan!

Agreed. Where is Google in China? FB? YouTube? Twitter? GitHub? ... the list goes on and on.

This decision does affect US consumers, but not in a significant way...we still have access to cheap smartphones.

Chinese companies can't have their cake and eat it too!

SAML and SCIM achieve two different use cases.

SCIM is specifically used for identity management (hence the name: System for Cross-domain Identity Management, or "SCIM"), whereas SAML is used to securely pass user information from an IDP to an application.

More consolidation in the age of corporate monopoly... I'm sure a nice exit for the founders and their investors.

+1

The issue with Keycloak is that it is never patched.

> Think of Keycloak as bleeding edge with quick releases, unpatched, and limited community support. [1]

Seems fine for research, but using it in production seems risky.

[1] http://www.keycloak.org/support.html

It includes an LDAP server to persist all the data generated by the service.

You can integrate your own backend LDAP server using the cache refresh feature: https://gluu.org/docs/ce/admin-guide/user-management/#ldap-s...

It is pretty beefy though, built for enterprise use cases.

Gluu Server supports U2F out of the box:

https://gluu.org/docs/ce/authn-guide/U2F/

Installation instructions:

https://gluu.org/docs/ce/installation-guide/

Yea, I coordinate with friends and family who have TV's. I also go to the theater more often.

But just getting the device out of our home space means that I won't, like the author of this post, relapse into old habits! :)

Yes, that's what I do as well.

Also, I go to the movies more often to see the films I'm actually interested in.

Baby Driver was my favorite movie of the year--in fact, the best movie I've seen in many years.

Dunkirk, Detroit, and Inconvenient Sequel all good as well!

I gave up my TV in January.

I don't miss the black mirror when it's turned off.

I don't miss making special space in my house for another screen.

I don't miss Netflix.

It has forced me to be more conscious about what I want to watch, and where and how.

There's a big difference between what people should do, and what people actually do. Research consistently shows that a large percentage of people reuse passwords across many sites.

[1] http://www.jbonneau.com/doc/DBCBW14-NDSS-tangled_web.pdf

But then you're storing passwords in more services, which creates more surface area for breaches.

If you shop with Amazon, host your services with Amazon, watch TV on Amazon...there's simply no way of getting around the fact that Amazon will only want to manage a password for you in one place. The issue is clearly over reliance on Amazon services.

Amazon offers many services, of course they are going to want users to have one set of credentials to access all those services.

There are trade-offs to every security approach, but storing passwords at every web service is 100x worse.

I feel like my company is the last to not use Google and Salesforce... There are a million reasons why Google could lock you out of an account... If I lose my personal email, I will survive. I can't in good faith accept that type of liability for my business communications though.

Why do you see this as a single sign-on issue? Seems to me the issue is over reliance on large SaaS providers. Same things happens all the time to Google users.

Well..you can wait for the whole world to learn English--which may eventually happen, but don't hold your breath--or you can be proactive and learn the languages you want to communicate in!

This recently happened to a friend of mine. It was devastating. As mentioned, U2F is very scarcely supported today.

The best way he came up with to secure services that insist on using SMS for 2FA (or credential reset) was to register the number of a pre-paid phone for those services.

Inconvenient? YES. But a pre-paid phone number can not be ported by a negligent (or willfully criminal!) operator.

Same exact thing happened to my friend who was using T Mobile.

This is my primary concern with SaaS identity providers--yes, they are easy to setup and administrate, but they are huge honey pots.

In addition, customers are unable to do any forensic analysis to determine how their data was affected.

> OneLogin’s blog post includes no other details, aside from a reference to the company’s compliance page.

The only option is to hope they provide customers with relevant information in a "timely manner", but that could be months for an organization with thousands of customers.

Yes, this is spot on.

The frequent usage of these terms is a dead giveaway that the proposed new rules would do the exact opposite.

Good point. Web views are no good. Google has introduced the new app auth libraries (for iOS and android) which are more secure.

My business partner wrote a blog about this topic: https://www.linkedin.com/pulse/webviews-bad-use-appauth-mike...

The app was again pulled from the app store almost immediately...

New blog published on this topic specifically:

http://gluu.co/jwt-not-authn

There's been some discussion regarding the merits of using JWT's (JSON Web Tokens) instead of Connect. Mike added some clarification in the form of a comment on the blog.

I also added it here [1]. Feel free to join the discussion on the blog.[2]

[1] https://news.ycombinator.com/item?id=13134752

[2] https://www.gluu.org/blog/oauth-vs-saml-vs-openid-connect/#c...

Mike replied to a comment about JWT's on the blog. Figured I'd also add it here for good measure.

Feel free to continue the discussion in the comments section of our blog.[1]

" JWT's are great. That's why they are used extensively in the OpenID Connect spec. The question is what's in that JWT? What are the claims? How do you know that the JWT that you got back in the response relates to the request you sent (i.e. Connect defines the nonce)? How do you know that the access token has not been modified (i.e. Connect defines the at_hash)? How do you know the code has not been modified (i.e. Connect defines the c_hash). How do you securely send the request? How does your client register and obtain tokens?

So yes, the puck is going towards JWT... but that's like saying the puck is going to JSON/REST... If you are using OAuth2 to authenticate a person, and you are using JWT, then you will have to define a lot of details to do so securely. Instead of making up your own recipe (which you probably don't have the time to do...), leverage the best practices defined by the experts at Google and Microsoft. "

[1] https://www.gluu.org/blog/oauth-vs-saml-vs-openid-connect/#c...

This is maddening! OpenID Connect is not an extension of OpenID 1 & 2--it is basically a complete re-write!

Thanks for all the upvotes everyone! If you'd like to connect with the author of the blog, Mike Schwartz, feel free to do so on LinkedIn: https://www.linkedin.com/in/nynymike