3 ms·
From circulating screenshots, and the omission in the listing here, it looks like they used this account to reset user passwords and MFA on a bunch of tenants.
by sascha_sl 5y ago
From circulating screenshots, and the omission in the listing here, it looks like they used this account to reset user passwords and MFA on a bunch of tenants. Not being able to create or delete users is meaningless.
- h0l0cube 5y agoFair call. That's an important clarification.
- kasey_junk 5y agoWhy is it a meaningless distinction to prevent account creation but allow password reset? Most commercial services allow unauthenticated password reset just by hitting a web form. It would send a password reset link to the correct place and the person would either ignore it, follow through and have a new password or report it. It doesn’t impact the service access at all. Meanwhile creating an account would allow new access to the system. I’m having a hard time figuring out how that’s not a world of difference?
- sascha_sl 5y agoApparently the "password reset" is more of a "password set" feature.
- kasey_junk 5y agoWhere was that outlined? All of the screen dumps I saw showed what looked like a reset.
- yibg 5y agoWhy is password reset considered a big issue? If I know your email / login I can go reset your password for a bunch of stuff now without any breach.