4 ms·
Posting a key in Slack is obviously not good opsec, but whether this is a big problem depends whether those keys allowed access to anything sensitive. They coul
by dboreham 5y ago
Posting a key in Slack is obviously not good opsec, but whether this is a big problem depends whether those keys allowed access to anything sensitive.
They could be keys allowing access to random test data, or public data, etc.
They could have been revoked immediately they were posted.
- Closi 5y agoIt does directly/partially contradict their statement though, i.e. > The potential impact to Okta customers is limited to the access that support engineers have Well the implication here is that the support engineer only had some limited set of tasks, but if that Support Engineer also indirectly had access to AWS keys then it suggests that Lapsus could have had broader access than just what the support engineer had direct access to.