4 ms·

Retool blames breach on Google Authenticator MFA cloud sync feature

22 points by talonx 3y ago

nijave 3y ago
I don't think cloud sync is fully to blame. They probably also should have been using hardware tokens instead of TOTP. There are also password managers like 1Password and Bitwarden that can store TOTP keys and sync them while still providing multiple layers of authentication (...and hardware key support)
- sieabahlpark 3y ago
  [dead]
branon 3y ago
"on-premise" - I think they actually mean on-premises. A premise and a premises are not the same thing. I see this mistake made all too often.
- placatedmayhem 3y ago
  "Premises" is plural of "premise". While it is usually plural in this context, singular usage isn't wrong. Further, since the meaning is conveyed, the usage is, ahem, "perfectly cromulent".
  - i_am_jl 3y ago
    "Premises" is a plural of "premise" but "premise" has nothing to do with land or buildings. "Premises" (plural of premise) and "premises" (tract of land and building(s)) are homonyms, not the same word. It's close enough that everyone knows what it means, but it's not right.
    - solardev 3y ago
      This is fascinating. It's such a common (mistaken) usage in the tech world, Dictionary says it's derived from the premise of a building deed, so it's not completely off. I wonder if there's a term, similar to "backronym", when the singular form of a word is derived from casual mutation from its plural?
      - i_am_jl 3y ago
        > Dictionary says it's derived from the premise of a building deed, so it's not completely off. Of course! The premises are "the matter previously stated" on a property deed. I did a very shallow search and nothing came up, thanks for pointing me in the right direction. >I wonder if there's a term, similar to "backronym", when the singular form of a word is derived from casual mutation from its plural? I think premises/premise(s) might be unique in English in that it's a singular noun, pluralized by adding an s, where the plural form is a homonym with another singular noun that is dissimilar in meaning to the root singular noun. Lots of words hit 2/3, but I can't think of any others that are all 3.
    - taway1237 3y ago
      Not a native English speaker here. What's a difference in technical context?
      - i_am_jl 3y ago
        If you're talking about a place, like where something is located, use 'premises'. 'On-prem' and 'Off-prem' are shorthand for "on/off the premises". If you're talking about a declarative statement used as the foundation of an argument, use "premise". Examples: "Were those databases moved to the cloud?" "No, they're still on the premises." (Premises = place) --------------------------------------- "Why did we decide to move those DBs to the cloud?" "On the premise that it's cheaper than managing the server administration ourselves." (Premise = something stated as the basis for an argument) --------------------------------------- "Can you give me a few more reasons that we moved those DBs to the cloud for the executive committee meeting?" "We made the decision on the premises that it's cheaper to run, our basement server room regularly floods, and our current server admin is a drunk." (Premises = plural of premise)
YouWhy 3y ago
0. Realistically, any mature MFA app needs to have a cloud backup option enabled by default. 1. Google did not message their induction of Authenticator cloud backups as having a massive impact on their clients' vulnerability surface. 2. It appears a bit from the post-mortem that Retool was considering itself as a SW company, rather than a security-critical infrastructure provider. 3. All of that adds up to - organizations that have much to lose from a compromise need to do their own security thinking and assessment. Corporate-style thinking along the lines of "if it has an enterprise offering, it must be up to scratch" was never enough, and it will never be.
htrp 3y ago
"After signing in, the attacker deepfaked an employee's voice and called the targeted IT team member, tricking them into providing an additional MFA code, which allowed the addition of an attacker-controlled device to the targeted employee's Okta account." Welcome to the future, where we are one step away from needing challenge-response authentication for in person face to face conversations.

22 points by talonx 3y ago

I don't think cloud sync is fully to blame. They probably also should have been using hardware tokens instead of TOTP. There are also password managers like 1Password and Bitwarden that can store TOTP keys and sync them while still providing multiple layers of authentication (...and hardware key support)

sieabahlpark 3y ago
[dead]

branon 3y ago

"on-premise" - I think they actually mean on-premises. A premise and a premises are not the same thing. I see this mistake made all too often.

placatedmayhem 3y ago
"Premises" is plural of "premise". While it is usually plural in this context, singular usage isn't wrong. Further, since the meaning is conveyed, the usage is, ahem, "perfectly cromulent".
- i_am_jl 3y ago
  "Premises" is a plural of "premise" but "premise" has nothing to do with land or buildings. "Premises" (plural of premise) and "premises" (tract of land and building(s)) are homonyms, not the same word. It's close enough that everyone knows what it means, but it's not right.
  - solardev 3y ago
    This is fascinating. It's such a common (mistaken) usage in the tech world, Dictionary says it's derived from the premise of a building deed, so it's not completely off. I wonder if there's a term, similar to "backronym", when the singular form of a word is derived from casual mutation from its plural?
    - i_am_jl 3y ago
      > Dictionary says it's derived from the premise of a building deed, so it's not completely off. Of course! The premises are "the matter previously stated" on a property deed. I did a very shallow search and nothing came up, thanks for pointing me in the right direction. >I wonder if there's a term, similar to "backronym", when the singular form of a word is derived from casual mutation from its plural? I think premises/premise(s) might be unique in English in that it's a singular noun, pluralized by adding an s, where the plural form is a homonym with another singular noun that is dissimilar in meaning to the root singular noun. Lots of words hit 2/3, but I can't think of any others that are all 3.
  - taway1237 3y ago
    Not a native English speaker here. What's a difference in technical context?
    - i_am_jl 3y ago
      If you're talking about a place, like where something is located, use 'premises'. 'On-prem' and 'Off-prem' are shorthand for "on/off the premises". If you're talking about a declarative statement used as the foundation of an argument, use "premise". Examples: "Were those databases moved to the cloud?" "No, they're still on the premises." (Premises = place) --------------------------------------- "Why did we decide to move those DBs to the cloud?" "On the premise that it's cheaper than managing the server administration ourselves." (Premise = something stated as the basis for an argument) --------------------------------------- "Can you give me a few more reasons that we moved those DBs to the cloud for the executive committee meeting?" "We made the decision on the premises that it's cheaper to run, our basement server room regularly floods, and our current server admin is a drunk." (Premises = plural of premise)

YouWhy 3y ago

0. Realistically, any mature MFA app needs to have a cloud backup option enabled by default. 1. Google did not message their induction of Authenticator cloud backups as having a massive impact on their clients' vulnerability surface. 2. It appears a bit from the post-mortem that Retool was considering itself as a SW company, rather than a security-critical infrastructure provider. 3. All of that adds up to - organizations that have much to lose from a compromise need to do their own security thinking and assessment. Corporate-style thinking along the lines of "if it has an enterprise offering, it must be up to scratch" was never enough, and it will never be.

htrp 3y ago

"After signing in, the attacker deepfaked an employee's voice and called the targeted IT team member, tricking them into providing an additional MFA code, which allowed the addition of an attacker-controlled device to the targeted employee's Okta account." Welcome to the future, where we are one step away from needing challenge-response authentication for in person face to face conversations.