3 ms·

> Step 1: get everyone and every app* (it’s never every app) into Okta You don't need to spend millions of dollars tethering your organization to a security id

> Step 1: get everyone and every app* (it’s never every app) into Okta You don't need to spend millions of dollars tethering your organization to a security identity provider to accomplish no more than what you already are doing without them. WebAuthn is not curing cancer. It's just another marketing scheme for authentication.

mnd999 3y ago
Okta seems super-dubious anyway. Didn’t it come out that they store passwords in plaintext and have internal superusers with access to multiple customers internal systems?
- TheNewsIsHere 3y ago
  Unaffiliated with Okta. As I recall, they had some internal support people that had access to some extraordinary privileges given their role at Okta. I understood through the grapevine that could potentially negotiate it so their support teams didn’t have any kind of standing access or non-US-based access over your Okta deployment, but only if you paid enough money.
kriops 3y ago
WebAuthn makes you unphishable, so there’s that. But that’s not to say Okta needs to be in the loop.
- slt2021 3y ago
  attackers are now creating fake Okta pages with <client name>.okta.com landing page and steal Okta user/pw
androidbishop 3y ago
Uh, what? 1. There are pretty damned good reasons to use a single sign on (SSO) authentication across all company resources. Managing multiple accounts for every employee across every service is a prohibitively burdensome and messy affair, error-prone, inconsistent in policy enforcement and quality of security, features that would difficult to roll out on your own, the list goes on. SSO is an absolute must in any modern organization. 2. WebAuthn just a marketing scheme? It's a pretty big jump forward in authentication security, protocol, user experience, etc. It eliminates passwords, the cornerstone of authentication for as long as computers have even had authentication, and the #1 cause for security breaches by far. It does away with the need for 2FA. It allows users to use a range of devices to easily authenticate themselves without the need to juggle credentials for every account they have. It uses public/private key cryptography, a robust standard for security for years, uniquely for each site, attested to prevent fake hosts from registering keys, and all automatically managed behind the scenes so nobody has to go through the painful song and dance of creating and managing their own keys anymore. And it does all of this with a universal and open protocol that is currently already baked into most browsers. Seems like a pretty big deal to me, and certainly a big enough deal for huge companies and services like Google, Github, Microsoft, etc. to have prioritized its development and rollout.

mnd999 3y ago

Okta seems super-dubious anyway. Didn’t it come out that they store passwords in plaintext and have internal superusers with access to multiple customers internal systems?

TheNewsIsHere 3y ago
Unaffiliated with Okta. As I recall, they had some internal support people that had access to some extraordinary privileges given their role at Okta. I understood through the grapevine that could potentially negotiate it so their support teams didn’t have any kind of standing access or non-US-based access over your Okta deployment, but only if you paid enough money.

kriops 3y ago

WebAuthn makes you unphishable, so there’s that. But that’s not to say Okta needs to be in the loop.

slt2021 3y ago
attackers are now creating fake Okta pages with <client name>.okta.com landing page and steal Okta user/pw

androidbishop 3y ago

Uh, what? 1. There are pretty damned good reasons to use a single sign on (SSO) authentication across all company resources. Managing multiple accounts for every employee across every service is a prohibitively burdensome and messy affair, error-prone, inconsistent in policy enforcement and quality of security, features that would difficult to roll out on your own, the list goes on. SSO is an absolute must in any modern organization. 2. WebAuthn just a marketing scheme? It's a pretty big jump forward in authentication security, protocol, user experience, etc. It eliminates passwords, the cornerstone of authentication for as long as computers have even had authentication, and the #1 cause for security breaches by far. It does away with the need for 2FA. It allows users to use a range of devices to easily authenticate themselves without the need to juggle credentials for every account they have. It uses public/private key cryptography, a robust standard for security for years, uniquely for each site, attested to prevent fake hosts from registering keys, and all automatically managed behind the scenes so nobody has to go through the painful song and dance of creating and managing their own keys anymore. And it does all of this with a universal and open protocol that is currently already baked into most browsers. Seems like a pretty big deal to me, and certainly a big enough deal for huge companies and services like Google, Github, Microsoft, etc. to have prioritized its development and rollout.