6 ms·

> the OneLog log-in platform shared by numerous Swiss media companies When will people understand that any centralized auth-related service is always going to

> the OneLog log-in platform shared by numerous Swiss media companies When will people understand that any centralized auth-related service is always going to be a prime target for criminal forces (hacking or not)? One really doesn't need an IQ higher than 50 to understand this.

ziddoap 2y ago
Obviously people realize that. However, that is only one factor among several that are considered when making that sort of decision.
technion 2y ago
One of the common statements in development and indeed here is "when will people realise you can't roll your own auth securely and should just use a third party service". There are a few security mantras that I wish we could get through to people on, but we security people are often guilty of having a correct answer that moves around based on what just occurred.
- alpaca128 2y ago
  I've never heard your version ending with "just use a third party service". Usually that phrase refers to libraries made by experts, not services that might be setup just as amateurish as one's own, with the drawback of monoculture on top.
rendaw 2y ago
So is a hundred random auth services developed by bit players and separate credentials for each better? I don't think there's an obvious answer or ideal, but I've also had trouble finding more comprehensive discussion on the subject.
- namaria 2y ago
  There's a false dichotomy in assuming the alternatives are 'single corporate borg' and 'a million little handrolled systems'. Separate websites and online services having their own authentication bubble but implemented with industry standard libraries would probably be a better alternative to both.
hulitu 2y ago
> One really doesn't need an IQ higher than 50 to understand this. People's IQ is not constant, especially in management. It depends highly on money and the amount of buzzwords that hit their ears.

ziddoap 2y ago

Obviously people realize that. However, that is only one factor among several that are considered when making that sort of decision.

technion 2y ago

One of the common statements in development and indeed here is "when will people realise you can't roll your own auth securely and should just use a third party service". There are a few security mantras that I wish we could get through to people on, but we security people are often guilty of having a correct answer that moves around based on what just occurred.

alpaca128 2y ago
I've never heard your version ending with "just use a third party service". Usually that phrase refers to libraries made by experts, not services that might be setup just as amateurish as one's own, with the drawback of monoculture on top.

rendaw 2y ago

So is a hundred random auth services developed by bit players and separate credentials for each better? I don't think there's an obvious answer or ideal, but I've also had trouble finding more comprehensive discussion on the subject.

namaria 2y ago
There's a false dichotomy in assuming the alternatives are 'single corporate borg' and 'a million little handrolled systems'. Separate websites and online services having their own authentication bubble but implemented with industry standard libraries would probably be a better alternative to both.

hulitu 2y ago

> One really doesn't need an IQ higher than 50 to understand this. People's IQ is not constant, especially in management. It depends highly on money and the amount of buzzwords that hit their ears.