5 ms·

I view this hack as a public service - we're seeing how awfully these big security companies actually handle security in the worst case. Let that be a lesson to

I view this hack as a public service - we're seeing how awfully these big security companies actually handle security in the worst case. Let that be a lesson to everyone who is in favour of mass centralisation. There needs to be a security solution where Okta essentially provides the skeleton of the infrastructure but not the entire solution, such that an Okta compromise does not compromise everyone who uses them.

qbasic_forever 5y ago
It's wild that apparently near full admin access to the service was handed out to subcontractors of subcontractors. There was so little oversight and so many levels of indirection that it took months to figure out the full impact of the breach and incident. This does not seem like a healthy or responsible security policy for a company whose primary business is... authentication security.
- tgsovlerkhgsel 5y ago
  But it was cheap!
- salmo 5y ago
  No, definitely not full admin access. Just a support tool called “SuperUser”. It was a customer service rep who could send password reset emails. Systems listed were that app and SaaS offerings. The laptop was vendor owned and managed. Given my experience, it probably had 0 access to anything “inside” Okta. There was no mention of vendor VPN or Virtual Desktop access. Or access to any internal system beyond what was a horribly named call center support tool. They really wouldn’t have passed the necessary audits for their enterprise and government customer base if they allowed 3rd party devices “real” access. Beyond a “hacker” getting access, there is very little trust in (likely) contract employees of a contract company. The fact that the tool is named Super User is killing them more than anything here.
- a2tech 5y ago
  And don't forget that they meet all the governments BS standards and auditing checks. So lots of government contractors use them.
staticassertion 5y ago
One company doing a bad job does not mean it's impossible or even uncommon to do a good job. Also, if you wanted to hedge against Okta... feel free. You can U2F 2FA your services behind Okta or in front of it. We use GSuite SSO, but everywhere we can set 2FA outside of it we do so.
- bigDinosaur 5y ago
  While true, Okta isn't some minor player that we can just wave away like this. I bet lots of other similar big companies will have similar issues - this is about much more than just their technical merit.
- pid-1 5y ago
  > does not mean it's impossible or even uncommon to do a good job. The only way one can reach this conclusion is by ignoring all the breaches / CVEs that happened in large companies during the past few years. Nowadays I just assume every company is crap at security unless proven otherwise.
  - staticassertion 5y ago
    I'm pretty up on my breaches :) Yes, most companies are bad at security. Some aren't though. The problem right now is figuring out which ones are - there's very little signal.
- jjav 5y ago
  > One company doing a bad job does not mean it's impossible or even uncommon to do a good job. We all know it is very uncommon to do a great job. Everyone has been breached sooner or later. Any anyone who has worked in engineering or security in tech companies knows how often security concerns are underprioritized far behind more visible but less important work. Hedging is a good answer. Relying on a single point of failure that, if it ever fails open, will expose everything at once? Not a smart idea.

qbasic_forever 5y ago

It's wild that apparently near full admin access to the service was handed out to subcontractors of subcontractors. There was so little oversight and so many levels of indirection that it took months to figure out the full impact of the breach and incident. This does not seem like a healthy or responsible security policy for a company whose primary business is... authentication security.

tgsovlerkhgsel 5y ago
But it was cheap!
salmo 5y ago
No, definitely not full admin access. Just a support tool called “SuperUser”. It was a customer service rep who could send password reset emails. Systems listed were that app and SaaS offerings. The laptop was vendor owned and managed. Given my experience, it probably had 0 access to anything “inside” Okta. There was no mention of vendor VPN or Virtual Desktop access. Or access to any internal system beyond what was a horribly named call center support tool. They really wouldn’t have passed the necessary audits for their enterprise and government customer base if they allowed 3rd party devices “real” access. Beyond a “hacker” getting access, there is very little trust in (likely) contract employees of a contract company. The fact that the tool is named Super User is killing them more than anything here.
a2tech 5y ago
And don't forget that they meet all the governments BS standards and auditing checks. So lots of government contractors use them.

staticassertion 5y ago

One company doing a bad job does not mean it's impossible or even uncommon to do a good job. Also, if you wanted to hedge against Okta... feel free. You can U2F 2FA your services behind Okta or in front of it. We use GSuite SSO, but everywhere we can set 2FA outside of it we do so.

bigDinosaur 5y ago
While true, Okta isn't some minor player that we can just wave away like this. I bet lots of other similar big companies will have similar issues - this is about much more than just their technical merit.
pid-1 5y ago
> does not mean it's impossible or even uncommon to do a good job. The only way one can reach this conclusion is by ignoring all the breaches / CVEs that happened in large companies during the past few years. Nowadays I just assume every company is crap at security unless proven otherwise.
- staticassertion 5y ago
  I'm pretty up on my breaches :) Yes, most companies are bad at security. Some aren't though. The problem right now is figuring out which ones are - there's very little signal.
jjav 5y ago
> One company doing a bad job does not mean it's impossible or even uncommon to do a good job. We all know it is very uncommon to do a great job. Everyone has been breached sooner or later. Any anyone who has worked in engineering or security in tech companies knows how often security concerns are underprioritized far behind more visible but less important work. Hedging is a good answer. Relying on a single point of failure that, if it ever fails open, will expose everything at once? Not a smart idea.