Trusting an SSO system, or anything with security sensitive data on the public internet presents an attack surface with untenable risk when your adversary is thousands of people with LLM tools.

It’s going to take a lot of this before people realise using someone else’s computer is a pretty fucking stupid idea.

I mean Entra and Okta got popped. That should have been the point companies looked at this risk and went nope.