4 ms·

Auth companies are high value targets for hackers. You'd think outsourcing auth is a smart idea because it's difficult to get auth right but otoh you might neve

by pier25 3y ago

Auth companies are high value targets for hackers. You'd think outsourcing auth is a smart idea because it's difficult to get auth right but otoh you might never have been a target if you hadn't used Okta.

williamcotton 3y ago
I was just having this conversation at work… How is it difficult to get web application authentication wrong at this point? It’s super well tread territory. Add your spices, a sprinkle of cookie crumbs, a token here or there, and then 2 hours in the oven and you’re done! And that’s rolling it entirely by hand. Most web frameworks have middleware that get you going in minutes.
- pier25 3y ago
  > How is it difficult to get web application authentication wrong at this point? Adding a log in to an app is no big deal but there are more complex scenarios to consider. Maybe single auth to multiple services, SSO, 2FA, OTP, Oauth, etc.
  - techdragon 3y ago
    This is literally the only value add in my mind. When you know it’s not just one simple app. When you know you’ve going to have frontends and backends and server to server tokens and third party and SSO and all the other TLA soup… then it starts to be something where im going “how much time could this save, would this be a good idea”
- infamouscow 3y ago
  Often it's really about positioning the business to minimize and avoid liability and risk of lawsuits, which is orthogonal to security. It's not a satisfying answer, but none of this will change until the public feels so strongly about this problem they become single-issue voters electing legislators to pass radically different laws.
  - wdb 3y ago
    But does a Okta or Azure AD etc take the liability, though?
- JonChesterfield 3y ago
  Would Okta be one of the things you can use to get authentication right in a few minutes? Aside from the whole Okta themselves don't know how to do this security lark thing that is
- deleted 3y ago
  [deleted]
- raxxorraxor 3y ago
  > How is it difficult to get web application authentication wrong at this point? It’s super well tread territory Implementing an auth flow to specification isn't trivial at all and that is a problem. Authn and authz get mixed up, people not checking tokens or their expiration, etc pp. There is probably a minefield of security issues here and some of those come to be because it is too complicated. Sure, there is middleware with sensible service integration, but you still need to do a lot of legwork in any case.
consumer451 3y ago
I would think that the same argument could me made for Managed Service Providers handling all IT work at any decent sized org. MSPs have to be one of the juiciest targets, and recent history would indicate that they are.
- pier25 3y ago
  Indeed. Heroku was hacked in 2022. https://www.bleepingcomputer.com/news/security/heroku-admits-that-customer-credentials-were-stolen-in-cyberattack/ https://www.bleepingcomputer.com/news/security/heroku-admits...
  - consumer451 3y ago
    Oh, I didn't mean cloud providers, I mean more like when a Fortune 500 company's management decides to shutdown their IT department and outsource the entire function to one of a handful of offshore companies who handle many other important companies as well. https://therecord.media/managed-service-providers-cyberattacks-warning-five-eyes https://therecord.media/managed-service-providers-cyberattac... https://darknetdiaries.com/transcript/103/ https://darknetdiaries.com/transcript/103/ > This is an interesting story since the threat actor targeted MSPs to go after their customers and then carry out their objectives from there. MSPs are pretty common. More and more companies are outsourcing their IT infrastructure, so to target them makes a lot of sense if your goal is to steal intellectual property. It’s sort of like going after the janitor’s key ring which can get you access into many buildings in town.

by pier25 3y ago

williamcotton 3y ago

I was just having this conversation at work… How is it difficult to get web application authentication wrong at this point? It’s super well tread territory. Add your spices, a sprinkle of cookie crumbs, a token here or there, and then 2 hours in the oven and you’re done! And that’s rolling it entirely by hand. Most web frameworks have middleware that get you going in minutes.

pier25 3y ago
> How is it difficult to get web application authentication wrong at this point? Adding a log in to an app is no big deal but there are more complex scenarios to consider. Maybe single auth to multiple services, SSO, 2FA, OTP, Oauth, etc.
- techdragon 3y ago
  This is literally the only value add in my mind. When you know it’s not just one simple app. When you know you’ve going to have frontends and backends and server to server tokens and third party and SSO and all the other TLA soup… then it starts to be something where im going “how much time could this save, would this be a good idea”
infamouscow 3y ago
Often it's really about positioning the business to minimize and avoid liability and risk of lawsuits, which is orthogonal to security. It's not a satisfying answer, but none of this will change until the public feels so strongly about this problem they become single-issue voters electing legislators to pass radically different laws.
- wdb 3y ago
  But does a Okta or Azure AD etc take the liability, though?
JonChesterfield 3y ago
Would Okta be one of the things you can use to get authentication right in a few minutes? Aside from the whole Okta themselves don't know how to do this security lark thing that is
deleted 3y ago
[deleted]
raxxorraxor 3y ago
> How is it difficult to get web application authentication wrong at this point? It’s super well tread territory Implementing an auth flow to specification isn't trivial at all and that is a problem. Authn and authz get mixed up, people not checking tokens or their expiration, etc pp. There is probably a minefield of security issues here and some of those come to be because it is too complicated. Sure, there is middleware with sensible service integration, but you still need to do a lot of legwork in any case.

consumer451 3y ago

I would think that the same argument could me made for Managed Service Providers handling all IT work at any decent sized org. MSPs have to be one of the juiciest targets, and recent history would indicate that they are.

pier25 3y ago
Indeed. Heroku was hacked in 2022. https://www.bleepingcomputer.com/news/security/heroku-admits-that-customer-credentials-were-stolen-in-cyberattack/ https://www.bleepingcomputer.com/news/security/heroku-admits...
- consumer451 3y ago
  Oh, I didn't mean cloud providers, I mean more like when a Fortune 500 company's management decides to shutdown their IT department and outsource the entire function to one of a handful of offshore companies who handle many other important companies as well. https://therecord.media/managed-service-providers-cyberattacks-warning-five-eyes https://therecord.media/managed-service-providers-cyberattac... https://darknetdiaries.com/transcript/103/ https://darknetdiaries.com/transcript/103/ > This is an interesting story since the threat actor targeted MSPs to go after their customers and then carry out their objectives from there. MSPs are pretty common. More and more companies are outsourcing their IT infrastructure, so to target them makes a lot of sense if your goal is to steal intellectual property. It’s sort of like going after the janitor’s key ring which can get you access into many buildings in town.