4 ms·
If there is one thing you want from a 3rd party auth provider, it's trust - this is not the time to play word games. I'd have far more faith in them if they we
by GordonS 5y ago
If there is one thing you want from a 3rd party auth provider, it's trust - this is not the time to play word games.
I'd have far more faith in them if they were transparent about what had happened, what they're doing about it, and how they will make sure it can't happen again.
Instead, they are being weasels - I for one, will not be using their services again, and this behaviour is the reason why.
Here's another example from a couple of years back where they used some really weasely language to claim they weren't vulnerable to a CVE (spoiler: they were):
https://twitter.com/jonoberheide/status/1506280347306188805?t=zcmm1nU3E5_zlcvFwIDt8w&s=03 https://twitter.com/jonoberheide/status/1506280347306188805?...
- deleted 5y ago[deleted]
- kache_ 5y agoMonoculturing the west's authorization/identity stack - Is that something we want to do? Authz/Authn as a service is great, until it isn't. There are pros and cons both ways. You're centralizing the risk, but also centralizing the effort for quality. Perverse incentives however causes loss of quality: saying you fucked up will lose you customers, and some of that sweet, sweet stock value. The fact that you can work for these companies without security clearance seems a bit insane. The more they grow and centralize, the more of a national security risk they become. It's not hard to get hired at Okta, and when you're in, you're in. At what point is not solving a security bug at Okta that you've discovered and selling it for monero more lucrative than actually fixing the bug? I realize that not everyone is like me and has a strong values that prevents them from doing so, and that scares me. If you're talented, it's super easy to backdoor a system and get around code-review I'm torn