Second, too complicated security setups often result in trivially hackable global passwords and shit like that because turns out, there are very few people willing to daily rotate and remember 30 different cryptographically random 256-bit arrays.
Third, no matter how robust your security setup is, there will always be someone who finds a flaw in it, so a much better solution is to just do bare minimum and get insurance.
It's strange to be that so many security experts are completely detached from how humans actually act.
[–] bcvvvy 23 hours ago
When we had local, properly integrated AD no one had to log into anything other than their computer.
The whole SSO / SAML thing is a huge regression in usability.
[–] RachelF 1 day ago
What always puzzles me about this stuff and critical infrastructure like nuclear powerplants, is why is an internal network connected to the public Internet at all?
If you have to connect it to the Internet, then why is it talking to unknown devices?
Instead they spend a huge chunk of their day logging into different services through a redirect via an SSO site. They don't have to have their password manager fill in new passwords each time. IME it doesn't actually save any time.
The advantage of SSO is the organization can ensure everyone is using the same security config. They can enforce a minimum password length for SSO. They can enforce 2FA for the SSO provider. Etc.