[fishpen0]

Unless of course you are a small fish who just needs sso for compliance and for some reason you get to pay like you are a $5B conglomerate despite still very much preferring to just pay an advertised price and not spend a month of people's time in negotiations

[TeMPOraL]

> a small fish who just needs sso for compliance

Unfortunately, a need for SSO is about the only reliable way to gouge a large corporation. As a small fish you may like SSO, want SSO, you may even think you need SSO, but you really can get by without just fine. You're small - you can get around the requirements, or pivot, or whatever. A corporation is big and slow and can easily get themselves into a situation where not adding SSO will become a blocker for deals denominated in double-triple digit millions, but abandoning your product or the whole business segment will cost similar amount of money. In that situation, the vendor can have a field day milking the cash cow.

[Aeolun]

> but you really can get by without just fine

The more time goes on, and the cheaper actually running SSO becomes, the less this is true. Props to Github for allowing me to do SSO on my 1 man enterprise for $21/month.

Even if you have just 20 people, not having to manage separate sign in’s on all services is just so pleasant. Not pleasant enough to jump from $2400/year to $24k/year on all 10 of them though.

[kuschku]

> As a small fish you may like SSO, want SSO, you may even think you need SSO, but you really can get by without just fine.

SSO is the only way to get 2FA working without the friction becoming prohibitive.

If SSO is a paid feature, only in some plans, you're selling an insecure product. You wouldn't make security patches exclusive to the enterprise plan, you shouldn't make 2FA/SSO exclusive either.

[TeMPOraL]

Computer systems security isn't binary. It's also not a human right. Or something anyone but small minority cares about beyond the surface level.

Extra security is a feature of enterprise plans precisely because enterprises are forced to buy them by compliance requirements (a good chunk of which is just security theater and blame shifting); no one else cares, people buy stuff, things mostly do not go wrong - a market balance is achieved.

I can see why this isn't ideal or desirable, but security maximalism also has a nasty habit of killing all utility of products and disempowering end-users, so I'm very much in the camp of trading security over other concerns.

[kuschku]

Re: security vs usability

That's precisely why SSO is so important. It's the only way to get people to use 2FA and strong passwords without compromising usability.

[OccamsMirror]

I feel this in my bones. Enterprise price haggling is the bane of my existence.

[IG_Semmelweiss]

you should then make a point to buy SaaS that puts pricing on their page. Cater to good practices.