Okta admits hackers accessed data on all customers during recent breach

https://techcrunch.com/2023/11/29/okta-admits-hackers-accessed-data-on-all-customers-during-recent-breach/

by throwaw12 • 3 years ago

63 20 3 years ago

As a rule of thumb, if you value the privacy or security of your users, never ever use services such as Okta. Product that rely on them are guaranteed to suffer from breaches. Told my clients that and i was right. It is a matter if time until the next breach.

fuzzylightbulb• 3 years ago

Given that roll your own is not an option for a lot of shops, what do you recommend?

doublerabbit• 3 years ago

Post-it notes and secret handshakes.

rzazueta• 3 years ago

If the org has a software development team, there's really no reason not to roll your own. As stated previously, this is a pretty well solved and well documented problem. A lot of development teams outsource this under the idea that authx is not their core competency, but I'd argue protecting customer data ought to be among every development org's core competency, otherwise they;re asking for trouble.

If you're talking about orgs that don't have a dev team and buy everything off the shelf / through SaaS... well, this is unfortunately part of the risk those orgs run. If you're manufacturing and shipping widgets in boxes, and your box supplier starts using cheaper materials that don't hold up to shipping, the only option is to switch box providers. Same here - if you're org relies on an IAM tool to allow employees to log into SaaS or other hosted software platforms and the IAM leaks data, the only real options are to switch providers or work with the existing provider to fix the damage.

gumballindie2• 3 years ago

How are we at a stage where setting up user management is not an option?

pier253• 3 years ago

Auth companies are high value targets for hackers. You'd think outsourcing auth is a smart idea because it's difficult to get auth right but otoh you might never have been a target if you hadn't used Okta.

consumer4512• 3 years ago

I would think that the same argument could me made for Managed Service Providers handling all IT work at any decent sized org.

MSPs have to be one of the juiciest targets, and recent history would indicate that they are.

pier253• 3 years ago

Indeed. Heroku was hacked in 2022.

https://www.bleepingcomputer.com/news/security/heroku-admits...

williamcotton• 3 years ago

I was just having this conversation at work…

How is it difficult to get web application authentication wrong at this point? It’s super well tread territory. Add your spices, a sprinkle of cookie crumbs, a token here or there, and then 2 hours in the oven and you’re done!

And that’s rolling it entirely by hand. Most web frameworks have middleware that get you going in minutes.

pier253• 3 years ago

How is it difficult to get web application authentication wrong at this point?

Adding a log in to an app is no big deal but there are more complex scenarios to consider. Maybe single auth to multiple services, SSO, 2FA, OTP, Oauth, etc.

infamouscow• 3 years ago

Often it's really about positioning the business to minimize and avoid liability and risk of lawsuits, which is orthogonal to security.

It's not a satisfying answer, but none of this will change until the public feels so strongly about this problem they become single-issue voters electing legislators to pass radically different laws.

JonChesterfield• 3 years ago

Would Okta be one of the things you can use to get authentication right in a few minutes? Aside from the whole Okta themselves don't know how to do this security lark thing that is

raxxorraxor• 3 years ago

How is it difficult to get web application authentication wrong at this point? It’s super well tread territory

Implementing an auth flow to specification isn't trivial at all and that is a problem. Authn and authz get mixed up, people not checking tokens or their expiration, etc pp. There is probably a minefield of security issues here and some of those come to be because it is too complicated.

Sure, there is middleware with sensible service integration, but you still need to do a lot of legwork in any case.

toomuchtodo• 3 years ago

Dupe: https://news.ycombinator.com/item?id=38454908

ImPostingOnHN• 3 years ago

This is a new story about how the breach wasn't limited to customer support accounts as that older story claimed.

aquaphile• 3 years ago

Remember RSA and OPM? The RSA hack had huge implications for the Department of Defense, and was probably a state-sponsored hack (likely China). Around the same time the Office of Personnel Management (OPM) was hacked. So the state-sponsored hackers got to all the private details of anyone with classified access and clearances (which can be used for blackmail or for answering those strange "Who was your 3rd grade teacher?" auth questions to get past an identity test), and simultaneously could hack the rotating MFA codes from RSA.

Auth companies will always be a high value target for state-sponsored espionage.

Okta admits hackers accessed data on all customers during recent breach

Related Stories