@encthenet@flyovercountry.social
Post #4277867
2026-07-30 22:31 UTC
@vees@jawns.club
You aren't trusting a user to [tell you to trust a party to] attest that the user is who they say they are? Are you saying you do a full security review or all the SSO providers (if any) you do trust? Or are you just trusting by their names/how large they are?
It actually gives the user control. E.g. passkeys are not 2FA, so with a SAML provider they can do real 2FA which they can't with passkeys.
It also lets the user use real 2FA on services that continue to think that an SMS counts as effective 2FA.
Replies (1)
-
@vees@jawns.club 2026-07-30 23:17
@encthenet@flyovercountry.social In most cases you are trusting the SSO to give you a unique identifier that you can leverage AND you're trusting the provider's security mechanisms as an extension of yours for account takeover. IDP size isn't *terrible* as a proxy of deciding if they're secure. I guess there's a world where you just check /.well-known/jwks.json and log your user's auth creds as iss+sub for subsequent logins if that's what they want, but then you'll have/need some secondary cred reset path anyway.