Okta Exposes Passwords in Clear Text for Possible Theft

Okta has always been a marketing organization first and a security organization second. Their support (and encouragement!) of bad protocols like SCIM and SAML are no surprise. Their target market are people who like easy solutions.

Re: Okta Exposes Passwords in Clear Text for Possible Theft

#6

Post by yardstick » Sun, Sep 25, 2022, 4:00 AM UTC

> For Okta's part, the passwords are in clear text because there is no standard reliable protocol for syncing hashes, researchers noted. However, Authomize noted that Okta did pledge to have its product team take a closer look at the password-leak risks.

What???

Can someone fill me in as to why they can’t just store the password using something like bcrypt?

I guess you either have to store the password in plaintext so they can do dynamic hashing operations on it, or transmit the password (via TLS hopefully) which is vulnerable to packet capture (or captured within the receiving app).

Are there any techniques for identity providers to authenticate people without storing or transmitting the users password to them?

Re: Okta Exposes Passwords in Clear Text for Possible Theft

#7

Post by ta988 » Sun, Sep 25, 2022, 4:01 AM UTC

downvotetruth wrote: post #3

& stock pops ~8% from 7/19~7/20

If you are in the US you may contact the SEC if you think those two are related.

Re: Okta Exposes Passwords in Clear Text for Possible Theft

#8

Post by de6u99er » Sun, Sep 25, 2022, 4:01 AM UTC

hericium wrote: post #2

This post is from July. And earlier this year: (March 22) Hackers claim to have breached Okta systems [1] (March 22) Updated Okta Statement on Lapsus$ [2] (March 23) Okta’s Investigation of the January 2022 Compromise [3] (March 27) Okta: “We made a mistake” delaying the Lapsus$ hack disclosure [4] (March 29) New documents for the Okta breach [5] [1] https://news.ycombinator.com/item?id=30762520 [2] https://news.ycom…

There seems to be a small copy/paste mishap.

[3] https://news.ycombinator.com/item?id=30775180

Re: Okta Exposes Passwords in Clear Text for Possible Theft

#9

Post by hericium » Sun, Sep 25, 2022, 4:04 AM UTC

de6u99er wrote: post #8

hericium wrote: post #2

This post is from July. And earlier this year: (March 22) Hackers claim to have breached Okta systems [1] (March 22) Updated Okta Statement on Lapsus$ [2] (March 23) Okta’s Investigation of the January 2022 Compromise [3] (March 27) Okta: “We made a mistake” delaying the Lapsus$ hack disclosure [4] (March 29) New documents for the Okta breach [5] [1] https://news.ycombinator.com/item?id=30762520 [2] https://news.ycom…

There seems to be a small copy/paste mishap. [3] https://news.ycombinator.com/item?id=30775180

Thanks!

Re: Okta Exposes Passwords in Clear Text for Possible Theft

#10

Post by hericium » Sun, Sep 25, 2022, 4:07 AM UTC

ta988 wrote: post #7

downvotetruth wrote: post #3

& stock pops ~8% from 7/19~7/20

If you are in the US you may contact the SEC if you think those two are related.

Out of curiosity: do you really have to be/live in the US? You're not permitted to contact them in such case if you're investing on the US market with proper IRS forms filled?