Hacker News Reader

I just use MTLS, MDM software like intune deploys the certificates.

Elsewhere in the org we have openAM which ties into AD and provides an OIDC/SAML integration.

Your blanket “don’t do authentication” statement is filled with so many specific circumstances and caveats which don’t apply to many difference cases it just sounds uninformed and thus arrogant.

View on HN

GP did agree that there are some cases where this doesn't apply:

> Not all businesses are the same, and I'm sure there are some where you need to run auth in-house (like if you're selling on-prem software), but I'm mindful that most companies simply cannot run auth securely.

Most companies have run auth for decades, typically via AD, but things like Novell before that.

Reply on news.ycombinator.com