11–20 of 50 posts
I'm not a user of OneLogin, but if they store encrypted passwords and encryption keys, their security model is fundamentally broken imho and I'd never give them my passwords. Better services (1password for example) are specifically designed to never know your master password/key to avoid this very situation.
Does any of those better designed services support Linux?
> After OneLogin customers sign into their account, the service takes care of remembering and supplying the customer’s usernames and passwords for all of their other applications. Isn't that at least somewhat analogous to using the same username and password on every site?
Kinda-sorta, in the same way a password manager is. It allows one strong password/2fa vs many likely weaker passwords. In reality OneLogin is typically using a federated login protocol like SAML or OIDC to grant access to third-party services. This means it can also be used to immediately revoke access, without having to reach out to and reconfigure various services.
Earlier quoted context omitted.
Kinda-sorta, in the same way a password manager is. It allows one strong password/2fa vs many likely weaker passwords. In reality OneLogin is typically using a federated login protocol like SAML or OIDC to grant access to third-party services. This means it can also be used to immediately revoke access, without having to reach out to and reconfigure various services.
For SAML at least if the identity provider is compromised, meaning I can now issue tokens using it's certificate, each service will need to be provided with a new certificate. That requires 'reach out' to each service,
Also don't forget having to audit each service's API keys/tokens/local users etc to make sure someone hasn't gotten access via a compromised certificate and then created a sneaky API key for them to use in the future.
Basically we had to assume every app had been compromised and rotate every internal key/certificate the was in each one, as well as reconfigure them with a new SAML certificate.
I'm not a user of OneLogin, but if they store encrypted passwords and encryption keys, their security model is fundamentally broken imho and I'd never give them my passwords. Better services (1password for example) are specifically designed to never know your master password/key to avoid this very situation.
I wonder if in this case OneLogin was the victim of a MITM attach while the attacker had access to their infrastructure?
So they didn't decrypt data at rest that they obtained but rather they captured activity in transit?
Either way it sounds like OneLogin had some implementation issues.
How was a central password store ever a good idea?
The worse alternatives is where the "top passwords" lists come from... those lists are from people that are not using any password store:
https://www.google.com/search?q=top+passwords+2017&ie=utf-8&...
The most horrible alternative I've seen: I once worked with a person who used his Outlook "contacts" as his "password manager." I discovered that after he quit and I was deactivating his accounts. Not only did he use Outlook "contacts" as his "password manager", but his passwords were discoverable (based on readily available personal information), guessable (e.g. pa$$word), and heavily reused either directly or as minor variations.
I'm not a user of OneLogin, but if they store encrypted passwords and encryption keys, their security model is fundamentally broken imho and I'd never give them my passwords. Better services (1password for example) are specifically designed to never know your master password/key to avoid this very situation.
Does any of those better designed services support Linux?