4 ms·
> The session cookies were stolen. 2FA has nothing to do with this. I had replied 5 hours earlier than your post already saying that I understood that. I was j
by insanitybit 3y ago
> The session cookies were stolen. 2FA has nothing to do with this.
I had replied 5 hours earlier than your post already saying that I understood that. I was just quoting from their report because I think it's interesting.
> Have you actually used Google Workspace for anything serious?
Yes lol I'd rather not comment on which of the companies I've worked at that used Google as an IDP but you're welcome to speculate - they all have thousands of employees and followed AWS best practices around user/role management. I can say that we used it at the company I founded as well, though.
- hnlmorg 3y agoI've seen places appear to use Google as an IDP but the reality was that Okta or Active Directory held the actual corporate identity management with a few select developer tooling hooked into a secondary domain hosted in Google Workspace. Those companies appear on the surface to be following best practices but leaver are constantly forgotten about because corporate IT will remove them from AD and nobody will tell "DevOps" (or whoever owns Google Workspace) to remove those same leavers as well. Which obviously then creates significant risk. Often these places end up with two domains because working with Corporate IT is painful for agile development scrums. But the issue there is company culture, not the IDP. I'm yet to see anyone use Google Workspace effectively at enterprise scale (startups, sure. But startups optimise for speed of development, not long term scalability).