Why we do not use social SSO yet
A short note on why BIM Mobius asks for an email and password instead of "Sign in with Google" — and when that calculus might change.
A common piece of feedback we get from users new to BIM Mobius: "where is the Sign in with Google button?" The answer is: we made a deliberate choice not to ship it yet. Here is the reasoning.
Identity ownership
License enforcement is the heart of the BIM Mobius commercial model. If a user signs in with a third-party identity provider and later disconnects that account, recovery becomes complicated and the trust chain to the license fingerprint gets brittle.
What we ship instead
- Argon2id-hashed passwords with a pepper rotated every 90 days
- JWT 1-hour access + rotating refresh tokens with reuse-detection
- TOTP 2FA with 10 recovery codes — required for admin, optional for users
- Trusted device opt-in skips the 2FA prompt for 30 days
- X25519 handshake on sensitive endpoints, regardless of TLS
When this might change
If enterprise customers ask for SAML / SCIM provisioning, we will ship that. Social SSO is a different shape and we have not seen the same demand for it from our AEC audience.
- Business
Hiring senior engineers in 2026: the 4-stage interview that respects their time
An 8-round loop that took 6 weeks and lost the top candidate to a 3-round competitor. The 4-stage rebuild — 60-min screen, paid 4-hour project, 90-min architecture, 45-min cultural — and the offer-acceptance lift.
- Business
B2B SaaS onboarding to "aha moment" in 7 minutes: the patterns that measurably activate
A signup that took 14 fields, 3 emails, and 22 minutes to first value. The teardown, the rebuild to 7 minutes, the activation lift of 38 %, and the patterns that actually moved the needle.
- Revit
Revit central file corruption recovery: when worksharing breaks at 4 p.m. Friday
A central file that throws "Cannot open" at 16:12 on a Friday with 22 modellers about to clock off. The local-to-central extraction, audit-recover-detach sequence, and prevention playbook.