willow9886

Sorry! DB crashed. It's back up. Thanks for alerting!

ForgeRock has a pretty comprehensive suite of open source IAM software [1] but you have to buy a subscription before you can put it into production.

There's also the open source KeyCloak project from RedHat. [2]

Also I believe Connect2ID is FOSS. [3]

[1] https://www.forgerock.com/

[2] http://www.keycloak.org/

[3] http://connect2id.com/

> that is close to okta functionality-wise?

The power of OKTA lies in its thousands of pre-configured SSO relationships. It's important to remember that each one was set up manually with a unique client ID and secret, metadata file, etc.

Application integration is the most difficult part of most identity and access management projects. That is why outsourcing identity to a SaaS provider like OKTA or OneLogin is so appealing--they have done all the hard work for you.

There are no open source projects like OKTA because if you're using open source software, you will inevitably have to integrate and test each application you want configured for SSO.

True, perhaps worth noting though that in OpenID Connect an RP (website or app) can actually request a specific authentication mechanism using the acr_value (assuming the OP supports multiple authentication mechanisms). This can give the application some input over how people are identified before authorizing access to protected resources.

http://openid.net/specs/openid-connect-core-1_0.html#acrSema...

Yubikey implements the FIDO open authentication standard. Yubico, the vendor that produces the Yubikey, is a co-author of the standard.

Read this for some background.[1]

[1] https://www.yubico.com/about/background/fido/

OK...but Google and my bank still use OTP over SMS to two-factor authenticate me. So clearly there's room for discussion and evangelism here. NIST can say that pigs fly, but until I see it in the wild I'm going to take it with a grain of salt.

I don't totally agree with this title change. Of course FIDO security keys improve security. What is interesting about this article and the research conducted is the comparative effectiveness of FIDO keys versus the much more widely deployed mechanism of SMS OTP.

There's always going to be a trade off between security, usability, and price. Physical keys are clearly more secure, but also come with increased price and some usability issues (e.g. if you don't have your key you're screwed). But as Google's research demonstrated, there are also usability issues with SMS OTP (3% avg failure rate vs 0% avg failure rate with keys).

Net-net, it depends on how sensitive the data is that your are protecting, and whether you prefer increased security or ease of use.

> My only complaint is the name of OpenID Connect is simply confusing.

Yea..many people only remember the failed OpenID 1 & 2 specs...so, out-of-the-box there is some developer fatigue associated with Connect. However, federation standards have proven to be pretty sticky--SAML was written 10+ years ago. Hopefully as Connect continues to be developed, marketed, and implemented by developers, it will over shadow previous unsuccessful versions of the protocol.

Updated the title to specify SMS OTP.

Thanks, Guy!

What are your thoughts on this statement, Guy?

I agree... it seems that getting the code into peoples hands would be a positive business driver. But once you raise $50m+ in venture capital, all bets are off.

I would encourage anyone who wants a truly open source IDP platform to consider the Gluu Server[1]. The Gluu Server supports open web standards for authentication and authorization, including SAML 2.0, OAuth 2.0, OpenID Connect, UMA, FIDO U2F, SCIM, and LDAP. It is one of the only--perhaps the only--enterprise-grade identity and access management platform that can be used in production, with an unlimited number of users, without paying a license.

[1] http://gluu.org

Typo in the "A built-in Q&A engine for community support" section..

publicaly -> publicly.

Yahoo's been authenticating me nearly every time I try to access the fantasy app on my phone. They've made me change my password 3 times in the past month or so. And the password I set doesn't seem to work, so I keep having to use their phone based authentication. With all the money that they have, it's hard to fathom how Yahoo is so bad at delivering secure identity services.

Yahoo's login experience has been horrible lately. This must be a contributing factor.

This is absolutely horrifying.

A few stats at a quick glance...

- US is responsible for nearly 1/2 of all gov't requests to Twitter for account info (2,520 / 5,676). 82% of those requests resulted in information being produced.

- US info requests specified 8,000+ accounts, translating into >60% of all accounts specified.

- Turkey's gov't responsible for ~40% of account removal requests...a staggering 1,781 requests, reporting 15,000 accounts (75% of all accounts reported during the term!)

Interesting that another trending story on HN contradicts google's post wrt the privacy features included in allo:

http://www.theverge.com/2016/9/21/12994362/allo-privacy-mess...

I had a feeling Google's representation of their respect for user privacy was too good to be true. Clearly they only have an interest in marketing privacy, as opposed to actually delivering effective privacy controlling tools and features.

Thank you!

Well said. We're also seeing greater demand now for our on premise FOSS software than ever before in the last 7 years.

In the article Sid mentions that "according to research, by 2019 80 cents of every dollar spent on software will go to on premises or single tenant software."

Does anyone know which research he's quoting?

This is quickly shaping up to be another "War on Drugs"... It's hard to determine whether UK lawmakers actually think bills like this will make them more secure, or if it's just one incremental move in a long term strategy to remove any assurance of privacy.

Either way the UK gov is looking highly incompetent.

To anyone interested in this article, I would recommend reading the book Bommerang: Travels in the New Third World by Michael Lewis: http://www.amazon.com/Boomerang-Travels-New-Third-World/dp/0...

So sad... RIP Pumpkin.

It seems that the DNC Chair, Debbie Wasserman Schultz, is doing everything in her power to stifle the democratic process. In addition to imposing a ridiculous ban on Bernie's campaign from accessing valuable DNC data, every single candidate, except notably the "frontrunner," Hillary, has questioned the absurdly low number of scheduled democratic debates: http://www.weeklystandard.com/dems-rally-today-against-debbi...

I encourage anyone who cares about seeing a fair electoral process sign this petition to remove her from her post: http://petitions.moveon.org/sign/remove-debbie-wasserman?sou...

Best of all, I found this article on....Yahoo.

Regardless of the political implications, this is an extremely sad situation that will surely be felt for many years to come...

I agree. It's probably also important to note that any long term hyper stressful activity, occupation, or profession will manifest a high percentage of partner and child abuse. So it's not just football or policing, it's symptomatic of a greater issue.

Sickening. Standard operating procedure for a militarized police force that is rarely held accountable.