4 ms·
> the threat-actor was able to hijack a session token from a support ticket which was created by a Cloudflare employee. If a threat-actor stole bank my passwor
by victor106 3y ago
> the threat-actor was able to hijack a session token from a support ticket which was created by a Cloudflare employee.
If a threat-actor stole bank my password because I stored it in a file on my laptop how is it my banks fault?
- lamontcg 3y agoIt was a support ticket opened on Okta's systems which got breached and leaked the info which was used to attack Cloudflare systems.
- victor106 3y agoThanks for correcting me. I re-read the article and I stand corrected. Okta is at fault here. That said, security is a really hard thing to get right 100% of the time. And there is no guarantee that another security vendor won’t have other issues. But Okta should’ve been more forthcoming communicating this.
- lamontcg 3y agoOkta has had a bunch of security issues fairly recently and the last one I recall reading was enough for me to not want to have anything to do with the company. This pretty much seals the deal for me. Compared to other businesses I've worked in, they seem to be having too many preventable security issues, and they're in the security business. Cloudflare's incident report here is what I'd consider forgivable and sounds like they take security very seriously, but they can't be perfect. Okta looks pretty bad.