Embed Notice

@alwayscurious @lanodan @theearthisapringle @swordgeek The vast majority of SSO systems I've encountered have bugs making it hard or impossible to login with a privacy conscious configuration. I'm not talking JS disabled, just things like 1p isolate, strong cross site tracker blocking, etc.

From a UX and privacy ecosystem standpoint, they're far worse than classic per site authentication.

I understand they sometimes reduce risk of breaches. I see that as lower priority to meeting *user* needs.

And in a gov post-DOGE context, they also leak information between gov entities (centralised records of who logs in to what) in ways that may be harmful to people's safety.