Re:Ask HN: Is it better to centralize authentication at a se...
by ecesena on Wednesday April 20, 2016 @11:58AM
(#11535352)
It's not only user interface, it's also security. A password is something that you have to remember. If you need 20 (distinct?) passwords, there's no way you can remember all of them, thus you'll resort to other ways to "remember" them. In most situations, this is actually lowering the security of the system.
Re:Ask HN: Is it better to centralize authentication at a se...
by jesseryoung on Wednesday April 20, 2016 @10:50AM
(#11534785)
You can also argue this same point from a security standpoint. Having a single centralized authentication that users must always sign in to and they are never required to sign in elsewhere will make users more aware of any phishing attempts. If a user suddenly sees a prompt in a different location or from a different service for their credentials they are less likely to just provide the credentials there and question it's authenticity.
Re:Ask HN: Is it better to centralize authentication at a se...
by mpbm on Wednesday April 20, 2016 @10:39AM
(#11534697)
That makes sense. The way my thoughts have been going from reading about this and passwordless authentication is that it's a lot more important WHO you trust than HOW you trust.
If both the user and the service independently trust the security agent, then each of them only needs to trust one actor.
It does imply an important discussion regarding how many eggs should go in one basket.
Re:Ask HN: Is it better to centralize authentication at a se...
by jiantastic on Sunday April 24, 2016 @06:59AM
(#11559269)
Kerberos basically.
Consider an intranet. If you have one password to log into all of your enterprise applications you are going to know how to log in and you will use all those applications.
If you have 20 different applications you use at work and you have 20 different logins, probably some of those services will end up in a state where you have to bug IT people to get a password reset when you ever need to use them. There will be others you just don't use at all, and maybe that suits management because they'd rather you didn't take time off from work anyway. (ex. application you use to claim time off from work)