Same story, but directly with the reporter:
One Token to rule them all – Obtaining Global Admin in every Entra ID tenant (13 days ago - 51 comment): https://news.ycombinator.com/item?id=45282497
The god mode vulnerability that should kill "Trust Microsoft" forever
21–30 of 33 posts
Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#22This article isn't just full of LLM-isms, it's unreadable because of it. When you completely delegate your editing to a machine, you're not just lazy, you're robbing yourself of the one thing that made you stand out --emdash-- your own voice. Moreover, as we navigate this evolving paradigm, we must carefully consider the balance between efficiency, authenticity and a third thing in this list. Maybe at the end of the…
I found the idea of a third thing in that list particularly persuasive.
You should. It was important in the classical study of rhetoric, given the name "tricolon".
Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#23> The root cause of this Microsoft vulnerability wasn’t poor coding or lack of testing. It also isn’t correct to say that it’s the need to trust Microsoft. It’s more accurately what we’re trusting Microsoft with — Authority.
> As long as someone or something holds it, it can be exploited.
Wide distribution, as opposed to centralization, seems to be the most reliable way to ensure continuity. Am I wrong in seeing this pattern in so many different areas? The distributed animal survives ecological or geological collapse in one region, the distributed activist group survives fed infiltration into one entity, the distributed army holds off the centralized one (with infinitely better funding and weaponry) for decades, the distributed political power survives demagogue takeover.
I might be abstracting way too far here, but it makes me wonder why we keep trying to centralize authority, when it keeps failing spectacularly.
Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#24Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#25The problem is the cloud. This sort of vulnerability is fundamentally impossible with an on-premise Exchange server and Active Directory. Once everyone's talking to and authenticating against one service, this sort of thing becomes difficult to avoid, especially when a company is bragging about how much code is written by LLMs now.
Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#26Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#27Same story, but directly with the reporter: One Token to rule them all – Obtaining Global Admin in every Entra ID tenant (13 days ago - 51 comment): https://news.ycombinator.com/item?id=45282497
Thanks, we marked this one as a duplicate, because a followup post about a post that has already had a significant discussion here can't sustain a new discussion.
Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#28As long as there is code their will remain a vulnerability.
All the security and compliances require that someone operates it, not everyone can design systems like Linux in an year or so.
The more darker truth is the entire existence of proprietary codebases and architectures, there's a saying either ask the question or forever remain foolish
It's time we ask it ourselves and the companies which we depend on to allow atleast open auditing their architecture
It's just one step but it prevents the level of exploits like these
Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#29The real issue is, what do you use instead that you can make the non-technical users accept? You can certainly move to google and get an overall improvement in track record and end user experience, but the fundamental issue raised in the article is still there You can move to proton and get a pretty nice experience for mail and calendar, but it adds limitations regular users will be upset by. Their equivalent to word…
The article does not discuss what to use instead of Microsoft's products, it discusses a better architecture for authorization than the one Microsoft uses. The architecture which Microsoft uses is flawed and too many companies rely on it.
The solution in short: "...distributed in the form a key who’s pieces live across a decentralized network."
If looking for alternatives to Microsoft's products I would recommend Infomaniak [0]. They have a fairly complete solution of business tools (email, contacts, calendar, cloud storage, file sharing, chat, video meetings, docs and sheets).
Re: The god mode vulnerability that should kill "Trust Microsoft" forever
#30Earlier quoted context omitted.
I found the idea of a third thing in that list particularly persuasive.
You should. It was important in the classical study of rhetoric, given the name "tricolon". https://en.wikipedia.org/wiki/Isocolon#Tricolon
Which (as mentioned there) has evolved into a form where all three things are the same: money, money, money, location, location, location, education, education, education, and of course developers, developers, developers.