Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OneLogin: Breach Exposed Ability to Decrypt Data

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#31

Post by manigandham »

jeffnolan wrote: post #28
manigandham wrote: post #26

Lots of confusion in all the posts about OneLogin - they are not a password manager like lastpass, they are a Single Sign-On (SSO) and Identity Provider, meaning they integrate with other services, maintain a master directory of all users, and provide a single login UI for all connected apps. Companies use OneLogin so employees have 1 service to enter their credentials and can then use federated access to apps like G…

it's a semantic argument. You are not storing passwords in an SSO service, but it is passing tokens to authenticate access based on the asserting/relying relationship between IdP and app. The reason I say it is semantic is that while you are not storing passwords, you are sitting on a trove of access credentials. What is different about an SSO app that is of huge value is that cutting off access is not a function of…

It's a purely informational comment about what the service is, not about the significance of the security breach.

Any identity related service, especially one that also includes password manager and desktop login functionality along with secure notes, etc. being involved in something like this is a major issue. We were looking at using them but have decided to stick with Google instead.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#32

Post by throwawhey3 »

subway wrote: post #6
mirimir wrote: post #4

> After OneLogin customers sign into their account, the service takes care of remembering and supplying the customer’s usernames and passwords for all of their other applications. Isn't that at least somewhat analogous to using the same username and password on every site?

Kinda-sorta, in the same way a password manager is. It allows one strong password/2fa vs many likely weaker passwords. In reality OneLogin is typically using a federated login protocol like SAML or OIDC to grant access to third-party services. This means it can also be used to immediately revoke access, without having to reach out to and reconfigure various services.

In cases where OneLogin provisioned third-party accounts for sites that didn't support SAML, they (at least used to) sync your OneLogin password to these third parties. It did not use unique per-site passwords.

If your OneLogin password was "pass123", so was the password for your OneLogin-managed accounts at Google, Salesforce, and so on. I believe but am not certain that this was even the case for some sites that used SAML but required passwords for non-HTTP access. Mail clients accessing Gmail is an example.

I do not know if this is still the case. I suspect it would not be difficult to check.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#34

Post by [deleted] »

jeffnolan wrote: post #30
dukedougal wrote: post #15

How was a central password store ever a good idea?

It's not a password store, SSO services like OneLogin are federated services that authenticate users with encrypted tokens. In a SAML transaction, or with OAuth, a username/password combination is never exchanged. How is this better, aside from user experience? For starters, the ability to disrupt access benefits from a single point rather than having to change passwords in every app. It also benefits from relying on…

[deleted]

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#35

Post by sbarre »

manigandham wrote: post #26

Lots of confusion in all the posts about OneLogin - they are not a password manager like lastpass, they are a Single Sign-On (SSO) and Identity Provider, meaning they integrate with other services, maintain a master directory of all users, and provide a single login UI for all connected apps. Companies use OneLogin so employees have 1 service to enter their credentials and can then use federated access to apps like G…

From reading many articles, it seems that OneLogin does have a service called "Password Cache", which sounds to me like a cache for passwords, perhaps for storing credentials to sites that do not have SSO..

See here: https://support.onelogin.com/hc/en-us/articles/201175264-Pas...

If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it somehow, and if the bad actor was able to intercept and decrypt data within the platform, then that may have included passwords stored using this mechanism perhaps

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#36

Post by EduardoBautista »

jeffnolan wrote: post #28
manigandham wrote: post #26

Lots of confusion in all the posts about OneLogin - they are not a password manager like lastpass, they are a Single Sign-On (SSO) and Identity Provider, meaning they integrate with other services, maintain a master directory of all users, and provide a single login UI for all connected apps. Companies use OneLogin so employees have 1 service to enter their credentials and can then use federated access to apps like G…

it's a semantic argument. You are not storing passwords in an SSO service, but it is passing tokens to authenticate access based on the asserting/relying relationship between IdP and app. The reason I say it is semantic is that while you are not storing passwords, you are sitting on a trove of access credentials. What is different about an SSO app that is of huge value is that cutting off access is not a function of…

OneLogin also stores passwords like 1Password. I used to work there.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#37

Post by closeparen »

mirimir wrote: post #4

> After OneLogin customers sign into their account, the service takes care of remembering and supplying the customer’s usernames and passwords for all of their other applications. Isn't that at least somewhat analogous to using the same username and password on every site?

An individual OneLogin relying party does not have credentials to leak that could be used anywhere else. It just verifies signed messages from OneLogin.

The sheer number of databases that have and can lose your password is most of the risk with password reuse.

Companies aren't going to maintain separate user tables for every authenticated service that employees use. The alternative is to have each service handle passwords directly and pass them through to an LDAP server, or run their own SAML IdP with considerable difficulty.

At least an individual company's IdP doesn't have the "hack many companies at once" target on its back.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#38

Post by wyc »

graystevens wrote: post #2

The recent update from Krebs gives some interesting details into how the attack took place, something we don't get to hear very often: “Our review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the US. Evidence shows the attack started on May 31, 2017 around 2 am PST. Through the AWS API, the ac…

Eerily similar to the controversial Instagram bug last year:

Post: http://www.exfiltrated.com/research-Instagram-RCE.php

Discussion: https://news.ycombinator.com/item?id=10754194

Leak your cloud provider keys, leak everything. These should be kept under close scrutiny and locked down as much as possible.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#40

Post by stcredzero »

sbarre wrote: post #35
manigandham wrote: post #26

Lots of confusion in all the posts about OneLogin - they are not a password manager like lastpass, they are a Single Sign-On (SSO) and Identity Provider, meaning they integrate with other services, maintain a master directory of all users, and provide a single login UI for all connected apps. Companies use OneLogin so employees have 1 service to enter their credentials and can then use federated access to apps like G…

From reading many articles, it seems that OneLogin does have a service called "Password Cache", which sounds to me like a cache for passwords , perhaps for storing credentials to sites that do not have SSO.. See here: https://support.onelogin.com/hc/en-us/articles/201175264-Pas... If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it som…

If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it somehow

By storing so many passwords in one system, they made that system a high value target, all while not having the security chops they thought they had.

Password vaults should be distributed. This prevents the conglomeration of password secrets that creates a high value target. They would've been wise to have a series of password vault apps that are integrated with their system. They could have done this by leveraging Password Safe.

Post reply on HN