9 ms·

> we were (for the second time) the victim of a compromise of Okta’s systems I'm curious if they're rethinking being on Okta.

Icathian 3y ago
The challenge being, who else could possibly handle Cloudflare's requirements? I imagine the next step is to build their own, and that's obviously not an easy pill to swallow.
- amluto 3y ago
  Why not? Cloudflare already operates a system that can help customers to require SSO for access to their services — why not try to capture more of that vertical by becoming an IdP?
- whalesalad 3y ago
  They already run their own zero trust infrastructure for customers, kinda surprised they are not dogfooding it. https://www.cloudflare.com/plans/zero-trust-services/ https://www.cloudflare.com/plans/zero-trust-services/
  - mikey_p 3y ago
    Did you read the article? They are using zero trust and explained that it's why the scope of the security incident was extremely limited.
  - jgrahamc 3y ago
    We use our Zero Trust stuff extensively. In fact, we built it for ourselves initially.
  - tomschlick 3y ago
    They are, but they don't have management for user accounts, 2fa, etc. You setup a connection to something like Okta, Google Apps, O365, SAML, etc to be your persistent user db and cloudflare just enforces it. I wouldn't be surprised if they are working on first party IAM user support though.
  - margalabargala 3y ago
    There are good reasons not to dogfood critical services like that; it can make recovering from unexpected issues much harder if you introduce mutual dependencies. For example, if Slack devops team were to exclusively communicate over Slack, then a Slack outage would be much harder to resolve because the team trying to fix it would be unable to communicate.
BytesAndGears 3y ago
My company will only give us new laptops that are preinstalled with Okta’s management system. I am grandfathered in to an old MacBook that has absolutely no management software on it, from the “Early Days” when there was no IT and we just got brand new untouched laptops. They offered me an upgrade to an M1/M2 pro, but I refused, saying that I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Since that would hugely disrupt my work, I can’t upgrade. Maybe I can use incidents like this to justify my beliefs to the IT department…
- verve_rat 3y ago
  Why do you need personal passwords on your laptop to do your work? I'm not understanding this.
  - BytesAndGears 3y ago
    Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos from my travel with coworkers, synching docs related to my work visa and taxes * Personal slack login for communicating with my partner in our private server * personal GitHub account credentials for synching my private dotfiles repo with my neovim config. basically can’t work without my dotfiles, but I could theoretically email these to myself or something, to prevent this one. And sure, I could be stubborn and not use any of this, but I’d be way less productive and kinda miserable.
    - MichaelZuo 3y ago
      Why don't you just do those on a second, personal, laptop? Does your workplace restrict you from bringing it in?
      - 3y ago
twisteriffic 3y ago
This wasn't really an additional failure at Okta. This was credentials lost during the original Okta compromise that CloudFlare failed to rotate out. Okta deserves criticism for their failure, but this feels like CloudFlare punching down to shift blame for a miss on their part.
- jamiesonbecker 3y ago
  Agreed, but Okta's still a $14B company.
- cowsandmilk 3y ago
  This wasn’t a new compromise, but there were still two Okta compromises that impacted CloudFlare January 2022: https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/ https://blog.cloudflare.com/cloudflare-investigation-of-the-... October 2023: https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/ https://blog.cloudflare.com/how-cloudflare-mitigated-yet-ano...
- bigbluedots 3y ago
  > They did this by using one access token and three service account credentials that had been taken, and that we failed to rotate, after the Okta compromise of October 2023 It's fair to "punch down" imo as that's how the credentials were originally compromised. I'd agree with you if CF were trying to minimize their own mistake but that doesn't seem to be what is happening here
  - BeefWellington 3y ago
    If a breach is disclosed and some time later your systems are compromised because you didn't bother to take appropriate action in response to that, it's not "fair" to punch down, or even reasonable to do so.
    - cheeze 3y ago
      Okta was painfully negligent, with CF going as far as posting "recommendations for Okta" because it was their only way to get through to them. I don't love CF, but IMO Okta deserves to be punched down on.
deleted 3y ago
[deleted]

Icathian 3y ago

The challenge being, who else could possibly handle Cloudflare's requirements? I imagine the next step is to build their own, and that's obviously not an easy pill to swallow.

amluto 3y ago
Why not? Cloudflare already operates a system that can help customers to require SSO for access to their services — why not try to capture more of that vertical by becoming an IdP?
whalesalad 3y ago
They already run their own zero trust infrastructure for customers, kinda surprised they are not dogfooding it. https://www.cloudflare.com/plans/zero-trust-services/ https://www.cloudflare.com/plans/zero-trust-services/
- mikey_p 3y ago
  Did you read the article? They are using zero trust and explained that it's why the scope of the security incident was extremely limited.
- jgrahamc 3y ago
  We use our Zero Trust stuff extensively. In fact, we built it for ourselves initially.
- tomschlick 3y ago
  They are, but they don't have management for user accounts, 2fa, etc. You setup a connection to something like Okta, Google Apps, O365, SAML, etc to be your persistent user db and cloudflare just enforces it. I wouldn't be surprised if they are working on first party IAM user support though.
- margalabargala 3y ago
  There are good reasons not to dogfood critical services like that; it can make recovering from unexpected issues much harder if you introduce mutual dependencies. For example, if Slack devops team were to exclusively communicate over Slack, then a Slack outage would be much harder to resolve because the team trying to fix it would be unable to communicate.

BytesAndGears 3y ago

My company will only give us new laptops that are preinstalled with Okta’s management system. I am grandfathered in to an old MacBook that has absolutely no management software on it, from the “Early Days” when there was no IT and we just got brand new untouched laptops. They offered me an upgrade to an M1/M2 pro, but I refused, saying that I wasn’t willing to use Okta’s login system if I have my own personal passwords or keys anywhere on my work computer. Since that would hugely disrupt my work, I can’t upgrade. Maybe I can use incidents like this to justify my beliefs to the IT department…

verve_rat 3y ago
Why do you need personal passwords on your laptop to do your work? I'm not understanding this.
- BytesAndGears 3y ago
  Fair question, but I use a lot of things that are varying degrees of helpful for my work: * personal ChatGPT and copilot subscriptions, since company doesn’t pay for these * Trello account for keeping track of my todo list (following up with people, running deploys) * Obsidian for keeping notes, as a personal knowledge-base (things like technologies and reminders) * Apple account for music, copy/paste, sharing photos from my travel with coworkers, synching docs related to my work visa and taxes * Personal slack login for communicating with my partner in our private server * personal GitHub account credentials for synching my private dotfiles repo with my neovim config. basically can’t work without my dotfiles, but I could theoretically email these to myself or something, to prevent this one. And sure, I could be stubborn and not use any of this, but I’d be way less productive and kinda miserable.
  - MichaelZuo 3y ago
    Why don't you just do those on a second, personal, laptop? Does your workplace restrict you from bringing it in?
    - 3y ago

twisteriffic 3y ago

This wasn't really an additional failure at Okta. This was credentials lost during the original Okta compromise that CloudFlare failed to rotate out. Okta deserves criticism for their failure, but this feels like CloudFlare punching down to shift blame for a miss on their part.

jamiesonbecker 3y ago
Agreed, but Okta's still a $14B company.
cowsandmilk 3y ago
This wasn’t a new compromise, but there were still two Okta compromises that impacted CloudFlare January 2022: https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/ https://blog.cloudflare.com/cloudflare-investigation-of-the-... October 2023: https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/ https://blog.cloudflare.com/how-cloudflare-mitigated-yet-ano...
bigbluedots 3y ago
> They did this by using one access token and three service account credentials that had been taken, and that we failed to rotate, after the Okta compromise of October 2023 It's fair to "punch down" imo as that's how the credentials were originally compromised. I'd agree with you if CF were trying to minimize their own mistake but that doesn't seem to be what is happening here
- BeefWellington 3y ago
  If a breach is disclosed and some time later your systems are compromised because you didn't bother to take appropriate action in response to that, it's not "fair" to punch down, or even reasonable to do so.
  - cheeze 3y ago
    Okta was painfully negligent, with CF going as far as posting "recommendations for Okta" because it was their only way to get through to them. I don't love CF, but IMO Okta deserves to be punched down on.

deleted 3y ago

[deleted]