2 ms·

This is an incident report from 1Password that I found more readable (PDF): https://blog.1password.com/files/okta-incident/okta-incident-report.pdf https://blog

• politelemon 3y ago
  Yes that's much better, the original article felt mixed up. So the culprit seems to have been the session information in the har. It made me wonder a few questions. What were they troubleshooting with Okta that required sending a har over, of their own interaction with Okta. And why are the session lengths so long, wouldn't Okta dogfood and use their own JWTs with limited lifetime?
• dang 3y ago
  Ok, we changed to that from https://arstechnica.com/security/2023/10/1password-detects-suspicious-activity-in-its-internal-okta-account/ https://arstechnica.com/security/2023/10/1password-detects-s... above. Thanks!