Google Mail's $5/seat offering is the first one that comes to mind.
04 May 2011
Starting with Chrome 13, we'll have HTTPS pins for most Google properties. This means that certificate chains for, say, https://www.google.com, must include a whitelisted public key. It's a fatal error otherwise.
https://www.imperialviolet.org/2011/05/04/pinning.html
ImperialViolet is Adam Langley’s personal technical blog. Langley worked at Google on HTTPS infrastructure and Chrome’s SSL stack.
A Tauri app, which is essentially a Chromium browser instance with no address bar and widgets to access browser settings, a Fastmail desktop "app" made with Tauri can potentially even the playing field between Google the Goliath and Fastmail the David on the TLS certificate pinning front. Tauri is like Electron but sucks a lot less.
https://tauri.app/
_
> if you've spending tens of thousands of dollars per month
Such as, 8,000 users at $40k/month for Google Mail.
Yubico has great volume discounts for a part of the CapEx side of a sane deployment of this.
The basic WebAuthn/FIDO2-only Yubikeys with a Fastmail logo on them would be, as the kids said a generation ago, "dope".
_
> where they have a Helpdesk
Quality attention to cicd and artifact release may avoid and potentially reduce conventional helpdesk activity.
For individual users of SaaS, provided the .dmg or .msi of the downstream Betterbird/Thunderbird (or other MUA) has sound cicd and decent release attention, no more additional support tickets than reasonable should occur beyond an initial phase.
A downstream MUA distro can eliminate manual configuration and superfluous details, such as the shit experience with Thunderbird on macOS (Thunderbird's fault 100%) with Oath2 I saw in the last few months. Such a distro could be tuned with a slew of relatively small adjustments reducing existing support ticket traffic.
Startups with headcount of 20 to 30, a good chunk of that being developers, where I have historically preferred to dwell, helpdesk is not there nor wanted for. Higher quality customers are here.
_
> and golden image deploys
Chromebooks, which not including K-12 did outnumber macOS in non-personal environments around a half-decade ago during that Event 201 thing. Super low IT overhead with those.
I have been distant from MIS type of IT for a while but have heard echoes or binocular'd in a bit and believe the golden image era has quietly passed us.
Conventional image pattern shouldn't be necessary anywhere now.
Somewhere in 2019, Apple warped native tooling in tandem with device firmware behavior to squeeze out the conventional image pattern ; killed it off.
Apple Business now includes built-in mobile device management which can enroll and set up Apple devices then apply standard settings and apps through "Blueprints" ; the .dmg would be trivial to push out. The successor to Jamf.
With Microsoft Intune, propagation of .msi packages to enrolled devices is a day-to-day task.
Ubuntu, RedHat, SuSE, Qubes, and all related distros, when under IT teams that can code on a rudimentary level, are managed with Ansible or Salt, without the "enterprise tax" part.
What all of these have in common is centralized org-wide device management where the ability to push out a .msi or .dmg or .deb/.rpm/.AppImage is there.
In similar spirit to certificate pinning, the advanced customers have dedicated private cicd consume source code from the OS vendor.
The more advanced are on
Bootstrappable builds: how and why
https://lwn.net/Articles/1088279/
which in tandem with cryptography-grade hashes, has over half way solved the "Trusting Trust" problem that Ken Thompson raised.
_
> what other SaaS consumer products use certificate pinning.
Slack has the low-hanging-fruit opportunity to with their Electron app, but has reportedly dropped the ball. This is great for tech workers who like to divert all Slack contents to a separate local data sink for archiving and discovery and non-shitty data access.
This repo from about seven years ago looks abandoned and inactive, but
https://github.com/myxious/electron-root-ssl-pinning
was not necessary for anyone who wanted to do it.
_
> let's expand it to banks and government departments in most countries.
With the episodic exposure I had with computer vision -> flow chart startups in the SF Bay Area many years ago, relatively ongoing time sinks with some archetypal MBA twat types, and some perceived legendary tier banks running on one of the two legit clouds (neither of which is that Azure garbage), who then fell on customer-facing downtime by not deploying with rudimentary cloud patterns that startups don't fail to do (as we recently found out), I am left feeling not confident that banks can do IT with self-reliance these days.
They can still push out .msi and group policy objects though, for sure.
From anecdotes I hear of and distant observations of state governments, departments of the big federal government sans some of the cooler TLA, and govs in Europe, I am not optimistic about those.
About a decade and a half ago we used to look at these two types of institutions and go "ah, the big guys, in their big buildings, they broker a thing I need, with their marble floors and reassuring smiles, these egregore have got it all figured out".
As a staff level DevOps / DevSecOps / whatever who has been along for the ride with a share of Silicon Valley culture-OS startups with enterprise customers, closely followed practices and white papers of hyperscalers and elite security firms, thus can see through any IT product/pattern transparently for its base principles...
-- having witnessed various sitcoms, heard of or read over 9,000 of first-hand accounts of such sitcoms, on top of the broadly spread cultural decay we are experiencing in the West upcoming on this Fourth Turning, with the rot of these institutions, and the major cultural shifts on computer illiteracy/obliviousness being normalized among "professionals" observed over the last couple of decades, I think more often than not some scrutiny of IT patterns at these institutions uncovers that they are severely retarded.
I suspect on the mid to lower end of the gov side it's just checkboxes, misdirection, and casual corruption almost all of the way down. Anyone who actually gives a shit about IT security and tries to fix things gets railroaded out.
The subcontractors who pick up the slack and handle real shit, like SpaceX is something NASA is dependent on (macro example), the upper echelon of the private sector, supranational organizations run by elite characters, are where not the progressive-minded IT teams are found but where IT is treated with some seriousness by leadership. But no transparency into IT patterns will be offered by these outside of talks at cool parties like DEF CON and AWS Re:Invent (shitty DJs but still a great party).