4 ms·

One of the reasons why we moved away from using Microsoft products for our identity management to Okta. Not that they are bad products per se, but as many orga

One of the reasons why we moved away from using Microsoft products for our identity management to Okta. Not that they are bad products per se, but as many organizations use Microsoft products they are prime targets for too many hackers and it’s hard going to bed thinking that your identity info might be hacked someday and/or not knowing if it will be. The surface area that Azure/Microsoft have is just too large for it to assume to be protected by one company whose security as not been the most stellar. So we are actively moving to GCP as well.

likecarter 3y ago
Okta has been hacked a couple times now...
- azemetre 3y ago
  Was about to say, wasn't all their source code stolen too? https://techcrunch.com/2022/12/22/okta-breach-source-code-github https://techcrunch.com/2022/12/22/okta-breach-source-code-gi... Okta looked very bad during the entire saga where they kept denying they were hacked until the proof was insurmountable. Pretty sure there was a large discussion on HN at the time too.
  - victor106 3y ago
    Agree they have shortcomings too, I guess, what I was trying to say is its best not to put all your eggs in one basket and to spread them across different products/companies.
    - azinman2 3y ago
      So, many weak links and no one technical is responsible with the macro vision?
- EthanHeilman 3y ago
  To toot my own companies horn[0] we designed our authentication protocol OpenPubkey[1] to have two signers on tokens: 1. The IDP signer (like microsoft or google) 2. The Cosigner (like bastionzero.com) ...so that even if microsoft's signing key is stolen, the attacker also needs to compromise the cosigner's signing key as well. It's like multisig for authentication tokens. I don't know if OpenPubkey would have helped in this particular case as the details are still coming out[2], but I think the future of authentication schemes must require that authentication tokens must be signed by multiple signers at different organizations; Authentication systems with single point of compromise signing keys is too fragile. Or put another way authentication via multiple independent roots of trust is just too powerful of a security tool not to use. [0]: BastionZero, https://bastionzero.com https://bastionzero.com [1]: OpenPubkey: Augmenting OpenID Connect with User held Signing Keys, https://eprint.iacr.org/2023/296 https://eprint.iacr.org/2023/296 [2]: It appears the key stolen was an MSA key, not an Azure AD signing key. The MSA architecture might not fit into the OpenPubkey model (or it might I don't know enough about MSA signing keys work to say). Had it been an Azure AD signing key then OpenPubkey would mitigate the theft of an Azure AD Signing key. https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana...
fsociety 3y ago
Okta is also a prime target for hackers, and likely has a smaller security budget than Microsoft.
AtNightWeCode 3y ago
We use MS for some stuff and did use Okta for others. But... Okta fkd up and can never be used in any enterprise today. We migrated from it. Everybody should. Now we use MS and Google. Okta is probably the most over-priced service in history of CS especially considering the poor sec design. They do however solve the US-Franchise-Corp bs that I guess it was designed for.

likecarter 3y ago

Okta has been hacked a couple times now...

azemetre 3y ago
Was about to say, wasn't all their source code stolen too? https://techcrunch.com/2022/12/22/okta-breach-source-code-github https://techcrunch.com/2022/12/22/okta-breach-source-code-gi... Okta looked very bad during the entire saga where they kept denying they were hacked until the proof was insurmountable. Pretty sure there was a large discussion on HN at the time too.
- victor106 3y ago
  Agree they have shortcomings too, I guess, what I was trying to say is its best not to put all your eggs in one basket and to spread them across different products/companies.
  - azinman2 3y ago
    So, many weak links and no one technical is responsible with the macro vision?
EthanHeilman 3y ago
To toot my own companies horn[0] we designed our authentication protocol OpenPubkey[1] to have two signers on tokens: 1. The IDP signer (like microsoft or google) 2. The Cosigner (like bastionzero.com) ...so that even if microsoft's signing key is stolen, the attacker also needs to compromise the cosigner's signing key as well. It's like multisig for authentication tokens. I don't know if OpenPubkey would have helped in this particular case as the details are still coming out[2], but I think the future of authentication schemes must require that authentication tokens must be signed by multiple signers at different organizations; Authentication systems with single point of compromise signing keys is too fragile. Or put another way authentication via multiple independent roots of trust is just too powerful of a security tool not to use. [0]: BastionZero, https://bastionzero.com https://bastionzero.com [1]: OpenPubkey: Augmenting OpenID Connect with User held Signing Keys, https://eprint.iacr.org/2023/296 https://eprint.iacr.org/2023/296 [2]: It appears the key stolen was an MSA key, not an Azure AD signing key. The MSA architecture might not fit into the OpenPubkey model (or it might I don't know enough about MSA signing keys work to say). Had it been an Azure AD signing key then OpenPubkey would mitigate the theft of an Azure AD Signing key. https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana...

fsociety 3y ago

Okta is also a prime target for hackers, and likely has a smaller security budget than Microsoft.

AtNightWeCode 3y ago

We use MS for some stuff and did use Okta for others. But... Okta fkd up and can never be used in any enterprise today. We migrated from it. Everybody should. Now we use MS and Google. Okta is probably the most over-priced service in history of CS especially considering the poor sec design. They do however solve the US-Franchise-Corp bs that I guess it was designed for.