4 ms·

> but most people I know in security have always had a poor view of Okta's security. What are their usual criticisms? Genuinely curious. I've always hated thei

> but most people I know in security have always had a poor view of Okta's security. What are their usual criticisms? Genuinely curious. I've always hated their UI, their docs, and lack of real support but felt that at least they had security going for them. The last assumption might have been proven wrong tonight. Also, what would be a reasonable alternative to Okta now that their nearest competitor, Auth0, was acquired by them. Is GSuite a reasonable alternative for SSO with multiple different providers and supporting SAML, etc.? Thanks in advance.

staticassertion 5y ago
A problem in infosec is information dissemination. Lots of their criticisms are based on backchannel information shared over drinks. It makes it difficult to discuss publicly. I wouldn't want to make a recommendation, but I'll say that my company uses GSuite.
vinay_ys 5y ago
A typical opsec issue in many companies even to this day is doing ssh shell access to critical systems and doing so with ldap passwords or user-controlled authorised keys and without 2FA and without host key verification. There are trivial browser based local network attacks to gain reverse shell access with such setups. Just because those systems are behind firewall and VPN, people tend to falsely believe they are more secure.
- porker 5y ago
  > or user-controlled authorised keys and without 2FA and without host key verification. There are trivial browser based local network attacks to gain reverse shell access with such setups. I'm struggling to see how that attack works without a copy of the private key. Any pointers for what to search for to understand this better?
  - talideon 5y ago
    The key thing here is _user controlled_ private keys: this means that those can leak, and if they leak, you're in trouble. A better solution is to use ephemeral SSH keys generated using an SSH CA. This kind of thing can be implemented with Hashicorp Vault, though I'm sure there are plenty of other solutions out there. It simplifies key checking on servers too, as they just need to the details of the signer and there's no need to juggle keys in LDAP.
    - notreallyserio 5y ago
      You'll still need a way to deliver those ephemeral ssh keys to a user controlled location, or make them indirectly usable by users (which amounts to the same thing).
      - talideon 5y ago
        In my company, we have a wrapper around `ssh` that handles that. That's the easy bit.
flo123456 5y ago
Jumpcloud seems to work quite nicely.

staticassertion 5y ago

A problem in infosec is information dissemination. Lots of their criticisms are based on backchannel information shared over drinks. It makes it difficult to discuss publicly. I wouldn't want to make a recommendation, but I'll say that my company uses GSuite.

vinay_ys 5y ago

A typical opsec issue in many companies even to this day is doing ssh shell access to critical systems and doing so with ldap passwords or user-controlled authorised keys and without 2FA and without host key verification. There are trivial browser based local network attacks to gain reverse shell access with such setups. Just because those systems are behind firewall and VPN, people tend to falsely believe they are more secure.

porker 5y ago
> or user-controlled authorised keys and without 2FA and without host key verification. There are trivial browser based local network attacks to gain reverse shell access with such setups. I'm struggling to see how that attack works without a copy of the private key. Any pointers for what to search for to understand this better?
- talideon 5y ago
  The key thing here is _user controlled_ private keys: this means that those can leak, and if they leak, you're in trouble. A better solution is to use ephemeral SSH keys generated using an SSH CA. This kind of thing can be implemented with Hashicorp Vault, though I'm sure there are plenty of other solutions out there. It simplifies key checking on servers too, as they just need to the details of the signer and there's no need to juggle keys in LDAP.
  - notreallyserio 5y ago
    You'll still need a way to deliver those ephemeral ssh keys to a user controlled location, or make them indirectly usable by users (which amounts to the same thing).
    - talideon 5y ago
      In my company, we have a wrapper around `ssh` that handles that. That's the easy bit.

flo123456 5y ago

Jumpcloud seems to work quite nicely.