OneLogin: Breach Exposed Ability to Decrypt Data • Hacker News Board

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#21

Post by xenophonf » Fri, Jun 02, 2017, 12:55 PM UTC

jupp0r wrote: post #9

I'm not a user of OneLogin, but if they store encrypted passwords and encryption keys, their security model is fundamentally broken imho and I'd never give them my passwords. Better services (1password for example) are specifically designed to never know your master password/key to avoid this very situation.

You misunderstand: OneLogin is a web SSO implementation, not a password manager. By necessity they have access to customers' authentication services because OneLogin functions as a SAML/OIDC identity provider. It's no different than if you ran AD FS or Shibboleth yourself.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#22

Post by pwman » Fri, Jun 02, 2017, 12:57 PM UTC

izacus wrote: post #10

jupp0r wrote: post #9

I'm not a user of OneLogin, but if they store encrypted passwords and encryption keys, their security model is fundamentally broken imho and I'd never give them my passwords. Better services (1password for example) are specifically designed to never know your master password/key to avoid this very situation.

Does any of those better designed services support Linux?

LastPass

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#23

Post by raverbashing » Fri, Jun 02, 2017, 1:56 PM UTC

dukedougal wrote: post #15

How was a central password store ever a good idea?

Yeah I used to be skeptical as well

In a perfect world, that is, if no service stored passwords with risible security, just remembering 2 or 3 strong passwords would be workable

Instead, since we live in a word where several system developers are inexperienced or just plain idiots, there is a need for passwords to be disposable

Password manager are worthy because they allow you to keep several different passwords and the strong password they require hopefully is not stored as MD5 anywhere.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#24

Post by willow9886 » Fri, Jun 02, 2017, 2:02 PM UTC

This is my primary concern with SaaS identity providers--yes, they are easy to setup and administrate, but they are huge honey pots.

In addition, customers are unable to do any forensic analysis to determine how their data was affected.

> OneLogin’s blog post includes no other details, aside from a reference to the company’s compliance page.

The only option is to hope they provide customers with relevant information in a "timely manner", but that could be months for an organization with thousands of customers.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#25

Post by EternalData » Fri, Jun 02, 2017, 2:44 PM UTC

I'm thinking of splitting my logins into a set of essential information in a paper journal -- while keeping some transactional passwords on 1password. 1password was one of those times where I decided to trade off convenience for absolute security -- which I'm realizing is a mistake.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#26

Post by manigandham » Fri, Jun 02, 2017, 2:53 PM UTC

Lots of confusion in all the posts about OneLogin - they are not a password manager like lastpass, they are a Single Sign-On (SSO) and Identity Provider, meaning they integrate with other services, maintain a master directory of all users, and provide a single login UI for all connected apps.

Companies use OneLogin so employees have 1 service to enter their credentials and can then use federated access to apps like Google, Office 365, Salesforce, etc without signing in again, most often connected via SAML which uses public/private keys. The identity provider can also be external, so for example users can sign-in via the OneLogin UI but the username/password are actually authenticated against Office 365 Active Directory instead.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#27

Post by perseusprime11 » Fri, Jun 02, 2017, 2:59 PM UTC

I use onelogin. Should I change my password?

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#28

Post by jeffnolan » Fri, Jun 02, 2017, 3:11 PM UTC

manigandham wrote: post #26

Lots of confusion in all the posts about OneLogin - they are not a password manager like lastpass, they are a Single Sign-On (SSO) and Identity Provider, meaning they integrate with other services, maintain a master directory of all users, and provide a single login UI for all connected apps. Companies use OneLogin so employees have 1 service to enter their credentials and can then use federated access to apps like G…

it's a semantic argument. You are not storing passwords in an SSO service, but it is passing tokens to authenticate access based on the asserting/relying relationship between IdP and app. The reason I say it is semantic is that while you are not storing passwords, you are sitting on a trove of access credentials. What is different about an SSO app that is of huge value is that cutting off access is not a function of changing passwords at the app level.

I think we agree on all the major points here, but I would not diminish the significance based on the fact that OneLogin is not a password vault.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#29

Post by idunno246 » Fri, Jun 02, 2017, 3:15 PM UTC

manigandham wrote: post #26

Lots of confusion in all the posts about OneLogin - they are not a password manager like lastpass, they are a Single Sign-On (SSO) and Identity Provider, meaning they integrate with other services, maintain a master directory of all users, and provide a single login UI for all connected apps. Companies use OneLogin so employees have 1 service to enter their credentials and can then use federated access to apps like G…

The other big thing is lots of saas companies don't implement multiple users per company initially, so you end up with a google doc with all the shared passwords of things like analytics/ads providers. This way you get a unique login, acls, etc by hiding the shared password inside onelogin

I've used these, but refused to put more important things like aws in there.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#30

Post by jeffnolan » Fri, Jun 02, 2017, 3:17 PM UTC

dukedougal wrote: post #15

How was a central password store ever a good idea?

It's not a password store, SSO services like OneLogin are federated services that authenticate users with encrypted tokens. In a SAML transaction, or with OAuth, a username/password combination is never exchanged. How is this better, aside from user experience? For starters, the ability to disrupt access benefits from a single point rather than having to change passwords in every app. It also benefits from relying on a credential from a directory service that can then be used to provision access within the target application, which means you can have more granular role-based or dynamic access based on metadata like time of day or geolocation.