Chapter 9 · 2000–2014

One identity, everywhere

Fifty passwords for fifty apps doesn't scale. So trust got concentrated — one identity per person, then one login across companies — which is both the convenience and the whole risk.

The “managing the access” branch left off with the VPN solving distance but not scale. Scale is this chapter’s problem, and it’s the one that ate the modern workday. You don’t log into one server anymore. You log into your email, your chat, your code host, your HR system, your expense tool, a dozen SaaS apps — most owned by different companies — before lunch. Fifty separate passwords is not security; it’s a Post-it note ecosystem. The answer, arrived at in stages over fifteen years, was to concentrate trust: prove yourself once, to one authority, and have everything else believe that authority.

It started inside the company. Active Directory, shipped with Windows 2000 and running on chapter 6’s Kerberos underneath, put every employee, group, and permission into a single corporate tree. One identity per person, one place to grant and revoke — an enormous improvement over every app keeping its own private list. But concentration cuts both ways, and this is the chapter’s recurring blade: the thing that holds everyone’s identity is now the thing whose compromise means everyone. Ask any ransomware crew what they hunt for first inside a network, and the answer is the domain controller. Consolidate the keys and you also consolidate the target.

Then trust crossed the company line. SAML, standardized in 2005, let your employer vouch for you to someone else’s website — the “sign in with your work account” button, and the foundation of the entire single-sign-on industry that companies like Okta were built on. Federation is the technical name: one organization’s identity provider asserting, by signed standard message, “this really is our employee Jane” to an app that trusts it. Jane logs in once and lands authenticated across everything her company federates. The password stops being presented fifty times; it’s presented once, to the one authority everyone else defers to.

OAuth (2012) added a subtler capability that quietly became the internet’s real currency: letting one app act on your behalf at another without ever seeing your password — scoped, revocable tokens instead of shared secrets. And OpenID Connect (2014) put login itself on top of OAuth, turning “Sign in with Google” into a standard any site could implement. Identity became infrastructure: a handful of identity providers now stand behind a huge fraction of the web’s logins. Trace the trust below and watch what it buys and what it concentrates.

Here is the thesis, wearing its enterprise suit. Every step in this chapter is management of the secret, not improvement of it. The password underneath your corporate SSO is often just as weak as it ever was — but now it’s presented once, to one hardened front door, protected by the second factors of the other branch, revocable in one place, logged centrally. That’s real security, and it’s entirely in the governance: the secret got weaker relative to its importance, and the wrapping got strong enough to carry the weight. The identity provider is the room divider promoted to load-bearing wall.

But concentration is a bet, and the bet has a tell. The whole edifice — directory, federation, single sign-on — still assumes there’s an inside worth being federated into: a trusted network, a corporate perimeter, a castle whose gate you’re now very good at guarding. Chapter 6 already showed the flaw in that assumption. Chapter 10 is where a company gets breached badly enough to stop assuming — and concludes that the fix isn’t a better wall. It’s no wall at all.