4 ms·

Wonder if we are ever going to known how this happened. Curious to know if Okta themselves were using best practices such as only using a hardware token as 2FA

Wonder if we are ever going to known how this happened. Curious to know if Okta themselves were using best practices such as only using a hardware token as 2FA (FIDO2) and disabling SMS 2FA and recovery.

pedrogpimenta 4y ago
[flagged]
- thedataangel 4y ago
  That's the stupidest password I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!
  - omgmajk 4y ago
    And yet it consistently ranks high on passwords still in use. This is a clickbaity article but there are better ones out there https://www.cnbc.com/2022/11/23/most-common-passwords-of-2022-make-sure-yours-isnt-on-the-list.html https://www.cnbc.com/2022/11/23/most-common-passwords-of-202...
    - nosianu 4y ago
      Just FYI for those who missed it: The previous comments were referring to the famous and really hilarious Mel Brooks movie "Spaceballs", this scene in particular: https://youtu.be/a6iW-8xPw3k https://youtu.be/a6iW-8xPw3k
      - toyg 4y ago
        I see that your schwartz is as big as mine
        throwanem 4y ago
        Now let's see how well you handle it.
  - karxxm 4y ago
    Definetly not true. This can be the best password in certain conditions. You should not put your "good" passwords to any shady site out there. You have no idea how passwords are stored on all these platforms one is registering to. If you can live with the fact, that an account may be hacked, then go for a super easy password if you want.
    - theta_d 4y ago
      You missed the joke. https://m.youtube.com/watch?v=a6iW-8xPw3k https://m.youtube.com/watch?v=a6iW-8xPw3k
    - darepublic 4y ago
      If you are following the policy of unique passwords per login then there is no need for "saving up the good passwords".
      - karxxm 4y ago
        Yeah, everyone in the world is tech savvy enough to work with password managers. Reality looks different, trust me.
    - LocalPCGuy 4y ago
      Excusing the fact it was a joke, on the serious side, a person shouldn't have any kind of set of "good" passwords. They should just have secure passwords they have auto-generated and have some way of retrieving the password from where they are stored when needed.
    - nixgeek 4y ago
      Or, just have a unique password for every site stored in a password manager, and then they can all be “good” passwords, with no big concerns about how they are stored!
      - grogenaut 4y ago
        Other than your eggs in one basket password apps being hacked and exfiltrating them all which would never happen. https://www.macrumors.com/2022/12/02/lastpass-hacked-second-time-2022/ https://www.macrumors.com/2022/12/02/lastpass-hacked-second-...
  - seanc 4y ago
    Remind me to change the combination on my luggage...
- RedShift1 4y ago
  solarwinds123
xander158 4y ago
You're assuming that the breach was done through the UI and not for example an oauth token or ssh key that was stolen from a developer's machine and used to download the source code by the attacker.
- Nextgrid 4y ago
  Another comment mentions GitHub themselves detecting the breach - in this case it's unlikely to be done via a compromised developer's laptop as the access would otherwise look normal and wouldn't trigger GH's security alerts.
  - Sankozi 4y ago
    Why would it always look normal? Different IP, different usage patterns could trigger the alert.
  - waspight 4y ago
    I think that they have alerts for when an access token is found in the wild, for instance. So it is quite possible.
  - noselasd 4y ago
    It would look abnormal if it was accessed from a dubious geolocation compared to normal access, which are things github can track and detect.
  - Aeolun 4y ago
    Depends, if someone suddenly starts pulling down every single repository in the org, that should ring some bells.
    - grogenaut 4y ago
      Meh... I do this every 6-8 months as a principal engineer. I've had many legit use cases.: Understanding our overall dependency tree, validating code coverage assumptions, seeing which projects built still, testing out prototype profiler reports, inspecting the code to see how hard adding x pattern would be, quantifying code change patterns over the pandemic, seeing which uses of the AWS sdk or internal clients were instrumented with metrics, seeing what pct would build under make/go build/bazel/etc. Anyway many legit reasons. Should it set off an alarm? Probably. Can you say before you do it? For sure!

pedrogpimenta 4y ago

[flagged]

thedataangel 4y ago
That's the stupidest password I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!
- omgmajk 4y ago
  And yet it consistently ranks high on passwords still in use. This is a clickbaity article but there are better ones out there https://www.cnbc.com/2022/11/23/most-common-passwords-of-2022-make-sure-yours-isnt-on-the-list.html https://www.cnbc.com/2022/11/23/most-common-passwords-of-202...
  - nosianu 4y ago
    Just FYI for those who missed it: The previous comments were referring to the famous and really hilarious Mel Brooks movie "Spaceballs", this scene in particular: https://youtu.be/a6iW-8xPw3k https://youtu.be/a6iW-8xPw3k
    - toyg 4y ago
      I see that your schwartz is as big as mine
      - throwanem 4y ago
        Now let's see how well you handle it.
- karxxm 4y ago
  Definetly not true. This can be the best password in certain conditions. You should not put your "good" passwords to any shady site out there. You have no idea how passwords are stored on all these platforms one is registering to. If you can live with the fact, that an account may be hacked, then go for a super easy password if you want.
  - theta_d 4y ago
    You missed the joke. https://m.youtube.com/watch?v=a6iW-8xPw3k https://m.youtube.com/watch?v=a6iW-8xPw3k
  - darepublic 4y ago
    If you are following the policy of unique passwords per login then there is no need for "saving up the good passwords".
    - karxxm 4y ago
      Yeah, everyone in the world is tech savvy enough to work with password managers. Reality looks different, trust me.
  - LocalPCGuy 4y ago
    Excusing the fact it was a joke, on the serious side, a person shouldn't have any kind of set of "good" passwords. They should just have secure passwords they have auto-generated and have some way of retrieving the password from where they are stored when needed.
  - nixgeek 4y ago
    Or, just have a unique password for every site stored in a password manager, and then they can all be “good” passwords, with no big concerns about how they are stored!
    - grogenaut 4y ago
      Other than your eggs in one basket password apps being hacked and exfiltrating them all which would never happen. https://www.macrumors.com/2022/12/02/lastpass-hacked-second-time-2022/ https://www.macrumors.com/2022/12/02/lastpass-hacked-second-...
- seanc 4y ago
  Remind me to change the combination on my luggage...
RedShift1 4y ago
solarwinds123

xander158 4y ago

You're assuming that the breach was done through the UI and not for example an oauth token or ssh key that was stolen from a developer's machine and used to download the source code by the attacker.

Nextgrid 4y ago
Another comment mentions GitHub themselves detecting the breach - in this case it's unlikely to be done via a compromised developer's laptop as the access would otherwise look normal and wouldn't trigger GH's security alerts.
- Sankozi 4y ago
  Why would it always look normal? Different IP, different usage patterns could trigger the alert.
- waspight 4y ago
  I think that they have alerts for when an access token is found in the wild, for instance. So it is quite possible.
- noselasd 4y ago
  It would look abnormal if it was accessed from a dubious geolocation compared to normal access, which are things github can track and detect.
- Aeolun 4y ago
  Depends, if someone suddenly starts pulling down every single repository in the org, that should ring some bells.
  - grogenaut 4y ago
    Meh... I do this every 6-8 months as a principal engineer. I've had many legit use cases.: Understanding our overall dependency tree, validating code coverage assumptions, seeing which projects built still, testing out prototype profiler reports, inspecting the code to see how hard adding x pattern would be, quantifying code change patterns over the pandemic, seeing which uses of the AWS sdk or internal clients were instrumented with metrics, seeing what pct would build under make/go build/bazel/etc. Anyway many legit reasons. Should it set off an alarm? Probably. Can you say before you do it? For sure!