5 ms·

> Support engineers are also able to facilitate the resetting of passwords and MFA factors for users, but are unable to obtain those passwords. Very ambiguous

> Support engineers are also able to facilitate the resetting of passwords and MFA factors for users, but are unable to obtain those passwords. Very ambiguous statement, not really fitting in with the whole "deeply committed to transparency" image they are trying to emit. What does "facilitate" really refer to here? If it was just triggering it, they would have said so, presumably. And why is only passwords mentioned as what couldn't be obtained and not the tokens from MFA as well, does that mean they could obtain those tokens? I wonder how it fits in with the groups own statements that they still have active access. Gonna be interesting to see what Lapsus$ replies to this statement.

phphphphp 5y ago
what I don’t get is, if support can’t do anything but “reset” which doesn’t expose the ability to gain access… how is support helping users? If a user can access their email, then they can reset themselves — surely? The idea that support can just trigger a reset email makes little sense. Perhaps Okta has some complex mechanisms that I am not aware of, but if this was any system I’ve ever worked on, an employee could take over an account if they so desired.
- deleted 5y ago
  [deleted]
- mdoms 5y ago
  You should do a stint in support. You'd be amazed how many people would rather interact with support than click the Forgot Password link.
  - phphphphp 5y ago
    As much as I’d like to forget, I’ve done a lot of support and much of that was authentication issues. I can certainly imagine in a corporate environment that some contingent of users would prefer to be hand-held through the reset request process, but all of them? My expectation (and experience of other similar systems) was that Okta would not allow password resets by anyone but the organization administrators. However, that doesn’t appear to match up with what has been disclosed here.
    - zerkten 5y ago
      It's easy to find a large segment of enterprise customers where handholding password resets is the only option because of an enterprise policy which is getting misapplied. Further, these support requests are probably unlimited in support contracts raking in significant income for Okta, so it becomes the default for customers not to worry about it. Any time companies are selling a product plus enterprise offerings, it becomes much more opaque as to what the complete product is. When organizations make the on-prem to cloud jumps they frequently are trading off oversight and experience. Many tenured internal teams have been broken apart by these types of migrations because they are ultimately sold to management as cost saving endeavors. These folks would make your observation about organizations admins controlling resets, but they are gone.
lalopalota 5y ago
It is not ambiguous. Facilitate means help. If a user cannot trigger the reset, support engineers can (help them) do it.
- chockchocschoir 5y ago
  In what way would a Okta user be unable to trigger the reset while a support engineer could? If they are unable to access the Okta website where the password reset gets initiated, they are also unable to access the very same Okta website where the new password would be set. And why use the more general word of "facilitate" when they could have been specific and say "trigger reset password flow" or similar. Hence their statement is ambiguous.
  - evan_ 5y ago
    It looks like there are some orgs where "forgot password" is restricted and has to go through an internal site admin- or an Okta CSE. There's not a "Reset password" link on cloudflare.okta.com for instance, just a link to contact their internal support. Regardless, "reset" can mean different things and it definitely seems like they're being cagey here by intentionally using imprecise language.
  - lalopalota 5y ago
    User's laptop is lost / stolen. User notifies supervisor. Supervisor (with admin authority on the account) notifies okta support and asks that the password be reset.
    - deleted 5y ago
      [deleted]
    - gkop 5y ago
      In this scenario, it’s more secure to require the user to request their own password reset via their registered email address.
      - 5y ago
Spooky23 5y ago
There are hundreds of call centers where all the workers do all day is fill out password screens. The exact nature about what they do varies by client and is probably subject to NDA. Password reset is the soft underbelly of most companies.

phphphphp 5y ago

what I don’t get is, if support can’t do anything but “reset” which doesn’t expose the ability to gain access… how is support helping users? If a user can access their email, then they can reset themselves — surely? The idea that support can just trigger a reset email makes little sense. Perhaps Okta has some complex mechanisms that I am not aware of, but if this was any system I’ve ever worked on, an employee could take over an account if they so desired.

deleted 5y ago
[deleted]
mdoms 5y ago
You should do a stint in support. You'd be amazed how many people would rather interact with support than click the Forgot Password link.
- phphphphp 5y ago
  As much as I’d like to forget, I’ve done a lot of support and much of that was authentication issues. I can certainly imagine in a corporate environment that some contingent of users would prefer to be hand-held through the reset request process, but all of them? My expectation (and experience of other similar systems) was that Okta would not allow password resets by anyone but the organization administrators. However, that doesn’t appear to match up with what has been disclosed here.
  - zerkten 5y ago
    It's easy to find a large segment of enterprise customers where handholding password resets is the only option because of an enterprise policy which is getting misapplied. Further, these support requests are probably unlimited in support contracts raking in significant income for Okta, so it becomes the default for customers not to worry about it. Any time companies are selling a product plus enterprise offerings, it becomes much more opaque as to what the complete product is. When organizations make the on-prem to cloud jumps they frequently are trading off oversight and experience. Many tenured internal teams have been broken apart by these types of migrations because they are ultimately sold to management as cost saving endeavors. These folks would make your observation about organizations admins controlling resets, but they are gone.

lalopalota 5y ago

It is not ambiguous. Facilitate means help. If a user cannot trigger the reset, support engineers can (help them) do it.

chockchocschoir 5y ago
In what way would a Okta user be unable to trigger the reset while a support engineer could? If they are unable to access the Okta website where the password reset gets initiated, they are also unable to access the very same Okta website where the new password would be set. And why use the more general word of "facilitate" when they could have been specific and say "trigger reset password flow" or similar. Hence their statement is ambiguous.
- evan_ 5y ago
  It looks like there are some orgs where "forgot password" is restricted and has to go through an internal site admin- or an Okta CSE. There's not a "Reset password" link on cloudflare.okta.com for instance, just a link to contact their internal support. Regardless, "reset" can mean different things and it definitely seems like they're being cagey here by intentionally using imprecise language.
- lalopalota 5y ago
  User's laptop is lost / stolen. User notifies supervisor. Supervisor (with admin authority on the account) notifies okta support and asks that the password be reset.
  - deleted 5y ago
    [deleted]
  - gkop 5y ago
    In this scenario, it’s more secure to require the user to request their own password reset via their registered email address.
    - 5y ago

Spooky23 5y ago

There are hundreds of call centers where all the workers do all day is fill out password screens. The exact nature about what they do varies by client and is probably subject to NDA. Password reset is the soft underbelly of most companies.