5 ms·

What a misleading and click-baity title choice by Ars Technica. This had nothing to do with Okta's platform, as implied. A third-party Vendor Okta used for hea

What a misleading and click-baity title choice by Ars Technica. This had nothing to do with Okta's platform, as implied. A third-party Vendor Okta used for health insurance information was breached, and personal information on Okta employees was stolen. I'm disappointed in Ars Technica, and Dan Goodin. edit: Updated to be more specific about what part of Okta this had nothing to do with.

ta1243 3y ago
Okta (or any company) can't outsource its responsibility when it outsources to a supplier. If Okta printed all that personal data and left it in a box on the street they would be liable.
- ryanisnan 3y ago
  Ok, but that's not what the article says. It says Okta was breached. Okta was not breached.
  - arrakeenrevived 3y ago
    It says Okta was "hit by" a breach, which it was. A breach happened, and Okta was impacted. Furthermore, it happened to data which Okta is ultimately responsible for, and Okta should be held responsible for their choices which led to their employees' data being stolen. I'm not sure why you're splitting hairs on this.
    - ethbr1 3y ago
      "another" is the weasel word It implies this breach is the same as the previous breach, which it's not. Ars has gone to shit over the last decade.
      - arrakeenrevived 3y ago
        I don't think I agree that the use of the word "another" implies that the breaches were equal, but I can see why others might interpret it that way. I won't disagree with opinion on the quality of Ars' reporting or this particular article, but I do disagree with the original comment's statement that "this had nothing to do with Okta".
        d3w4s9 3y ago
        Without knowing the context, I doubt anyone reading the title is thinking "maybe they mean another breach where Okta is impacted but Okta is not the culprit, despite recent events". No, the title is simply misleading. They could have swapped Okta for another company's name or something like "Personal information stolen in healthcare company breach", and the news likely wouldn't get much attention, which is as much as what the article is actually worth. Singling out Okta among many of that company's clients is simply meaningless and wrong and does nothing other than attention grabbing.
        3c6bYDXLMj 3y ago
        Immediately what I thought when I read it. The person you’re responding to is being obtuse to the point where it feels like trolling or contrarianism for the sake of contrarianism. Certainly a bad-faith argument.
      - ryanisnan 3y ago
        > but I do disagree with the original comment's statement that "this had nothing to do with Okta". I could have probably phrased this as "this had nothing to do with Okta's technology."
    - d3w4s9 3y ago
      Because context and sentiment matters. By your logic clickbait is perfectly fine and we should maybe do more because they are (usually) technically correct.
      - BeefWellington 3y ago
        Just continue reading the title all the way to the end? I know it's a long haul but come on, we can't just stop at the first bit of punctuation: > Okta hit by another breach, this one stealing employee data from 3rd-party vendor It's clear a breach has affected Okta employees.
  - croes 3y ago
    It says Onta was hit by a breach, Okta was hit ny a breach, it even says that is was a third party vendor. That's exactly what happened.
    - junon 3y ago
      The problem is the article is farming clicks by piggie backing off of the very recent and public breach Okta had. I don't know if there's a term for this, but it's clear to me they're abusing oktas name.
- paulddraper 3y ago
  Re-read the above comment. Okta the company had a breach. Okta the platform did not. Employee data vs customer data
api 3y ago
Maybe someone is short selling.
- eli 3y ago
  The truth is usually less exciting.
- OJFord 3y ago
  Someone(s) almost certainly (are), not necessarily relatedly (to the article, to the breaches, yeah absolutely), what a pointlessly vague thing to say.
- lofatdairy 3y ago
  The concept of journalists trading on the news they break is coincidentally making waves right now with this new startup called Hunterbrook[^1]. I assume that outright misleading headlines won't be something they'd risk, but it's an interesting concept, since, yeah normally this is something you'd accuse someone of, and not expect that to be the whole point. [^1]: https://www.ft.com/content/3c861c6c-87be-459d-b62f-b44bf2d750ac https://www.ft.com/content/3c861c6c-87be-459d-b62f-b44bf2d75...
coldcode 3y ago
https://www.rightwayhealthcare.com https://www.rightwayhealthcare.com is the company mentioned in the article. Okta is shown as a customer on the website, and the company's marketing says "Our members love using Rightway". There is zero mention of security on their website that I see, but the website is entirely marketing and self-congratulatory. I would expect that other Rightway customers were likely also affected, but they had no comment mentioned in this article so how wide the breach was is unknown. Okta is a well-known company so that's why this article focused on them, which is not the real story, but I guess like you said clickbait.
- coldcode 3y ago
  Okta is promoting Rightway as a benefit of Okta: https://rewards.okta.com/us/healthcare/medical/rightway-healthcare https://rewards.okta.com/us/healthcare/medical/rightway-heal...
dang 3y ago
Thanks. I've belatedly changed the title above.
urda 3y ago
Honestly Ars has really fallen in the past few years.
chriscjcj 3y ago
ARS commenters seem to have created a very specific kind of echo chamber and they guard it passionately, fiercely rebuking any and all dissenting opinions into oblivion. Sadly, ARS writers seem motivated to cater these folks' predilections. Sometimes it seems like they write articles with little purpose other than to provide grist for their beloved mob's mill. Perhaps these journalists are rewarded for 'high audience engagement.' So glad HN hasn't devolved into that. Gratitude to the mods here.

ta1243 3y ago

Okta (or any company) can't outsource its responsibility when it outsources to a supplier. If Okta printed all that personal data and left it in a box on the street they would be liable.

ryanisnan 3y ago
Ok, but that's not what the article says. It says Okta was breached. Okta was not breached.
- arrakeenrevived 3y ago
  It says Okta was "hit by" a breach, which it was. A breach happened, and Okta was impacted. Furthermore, it happened to data which Okta is ultimately responsible for, and Okta should be held responsible for their choices which led to their employees' data being stolen. I'm not sure why you're splitting hairs on this.
  - ethbr1 3y ago
    "another" is the weasel word It implies this breach is the same as the previous breach, which it's not. Ars has gone to shit over the last decade.
    - arrakeenrevived 3y ago
      I don't think I agree that the use of the word "another" implies that the breaches were equal, but I can see why others might interpret it that way. I won't disagree with opinion on the quality of Ars' reporting or this particular article, but I do disagree with the original comment's statement that "this had nothing to do with Okta".
      - d3w4s9 3y ago
        Without knowing the context, I doubt anyone reading the title is thinking "maybe they mean another breach where Okta is impacted but Okta is not the culprit, despite recent events". No, the title is simply misleading. They could have swapped Okta for another company's name or something like "Personal information stolen in healthcare company breach", and the news likely wouldn't get much attention, which is as much as what the article is actually worth. Singling out Okta among many of that company's clients is simply meaningless and wrong and does nothing other than attention grabbing.
        3c6bYDXLMj 3y ago
        Immediately what I thought when I read it. The person you’re responding to is being obtuse to the point where it feels like trolling or contrarianism for the sake of contrarianism. Certainly a bad-faith argument.
    - ryanisnan 3y ago
      > but I do disagree with the original comment's statement that "this had nothing to do with Okta". I could have probably phrased this as "this had nothing to do with Okta's technology."
  - d3w4s9 3y ago
    Because context and sentiment matters. By your logic clickbait is perfectly fine and we should maybe do more because they are (usually) technically correct.
    - BeefWellington 3y ago
      Just continue reading the title all the way to the end? I know it's a long haul but come on, we can't just stop at the first bit of punctuation: > Okta hit by another breach, this one stealing employee data from 3rd-party vendor It's clear a breach has affected Okta employees.
- croes 3y ago
  It says Onta was hit by a breach, Okta was hit ny a breach, it even says that is was a third party vendor. That's exactly what happened.
  - junon 3y ago
    The problem is the article is farming clicks by piggie backing off of the very recent and public breach Okta had. I don't know if there's a term for this, but it's clear to me they're abusing oktas name.
paulddraper 3y ago
Re-read the above comment. Okta the company had a breach. Okta the platform did not. Employee data vs customer data

api 3y ago

Maybe someone is short selling.

eli 3y ago
The truth is usually less exciting.
OJFord 3y ago
Someone(s) almost certainly (are), not necessarily relatedly (to the article, to the breaches, yeah absolutely), what a pointlessly vague thing to say.
lofatdairy 3y ago
The concept of journalists trading on the news they break is coincidentally making waves right now with this new startup called Hunterbrook[^1]. I assume that outright misleading headlines won't be something they'd risk, but it's an interesting concept, since, yeah normally this is something you'd accuse someone of, and not expect that to be the whole point. [^1]: https://www.ft.com/content/3c861c6c-87be-459d-b62f-b44bf2d750ac https://www.ft.com/content/3c861c6c-87be-459d-b62f-b44bf2d75...

coldcode 3y ago

https://www.rightwayhealthcare.com https://www.rightwayhealthcare.com is the company mentioned in the article. Okta is shown as a customer on the website, and the company's marketing says "Our members love using Rightway". There is zero mention of security on their website that I see, but the website is entirely marketing and self-congratulatory. I would expect that other Rightway customers were likely also affected, but they had no comment mentioned in this article so how wide the breach was is unknown. Okta is a well-known company so that's why this article focused on them, which is not the real story, but I guess like you said clickbait.

coldcode 3y ago
Okta is promoting Rightway as a benefit of Okta: https://rewards.okta.com/us/healthcare/medical/rightway-healthcare https://rewards.okta.com/us/healthcare/medical/rightway-heal...

dang 3y ago

Thanks. I've belatedly changed the title above.

urda 3y ago

Honestly Ars has really fallen in the past few years.

chriscjcj 3y ago

ARS commenters seem to have created a very specific kind of echo chamber and they guard it passionately, fiercely rebuking any and all dissenting opinions into oblivion. Sadly, ARS writers seem motivated to cater these folks' predilections. Sometimes it seems like they write articles with little purpose other than to provide grist for their beloved mob's mill. Perhaps these journalists are rewarded for 'high audience engagement.' So glad HN hasn't devolved into that. Gratitude to the mods here.