Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OneLogin: Breach Exposed Ability to Decrypt Data

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 50 posts

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#41

Post by brazzledazzle »

These SSO providers like OneLogin and Okta are incredibly high value targets. State-level targets. I predict that SSO providers and security tools (whether on-prem or SaaS) will be targeted and breached more and more often. The SSO providers are the middle men for accessing everything so they literally have the keys to the kingdom. Security tools are given incredible amounts of access and permissions without question.

As a result of trying to be more secure a big enterprise has gone from maybe a couple single points of compromise to several. It's not as easy to do script kiddie-level attacks but the tradeoff is that a very smart and/or well funded attacker now has some very, very powerful targets.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#42

Post by danbruc »

sbarre wrote: post #35
manigandham wrote: post #26

Lots of confusion in all the posts about OneLogin - they are not a password manager like lastpass, they are a Single Sign-On (SSO) and Identity Provider, meaning they integrate with other services, maintain a master directory of all users, and provide a single login UI for all connected apps. Companies use OneLogin so employees have 1 service to enter their credentials and can then use federated access to apps like G…

From reading many articles, it seems that OneLogin does have a service called "Password Cache", which sounds to me like a cache for passwords , perhaps for storing credentials to sites that do not have SSO.. See here: https://support.onelogin.com/hc/en-us/articles/201175264-Pas... If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it som…

If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it somehow [...]

But not necessarily all of them all the time. The decryption key could be derived from the master password of each user and only kept around while the user is logged in.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#43

Post by mnm1 »

'Gartner Inc. financial fraud analyst Avivah Litan said she has long discouraged companies from using cloud-based single sign-on services, arguing that they are the digital equivalent to an organization putting all of its eggs in one basket.'

So it's better if that single point of failure the company puts all its eggs into is a hacked piece of shit by an engineer who couldn't build a secure login system if his life depended on it? This is a serious question and one that I've been struggling with at my current work and at every other job I've had in this industry without exaggeration. Plaintext passwords, passwords encrypted with an easily obtainable key, insecure hashes, no salts, etc. These things are the norm in DIY login schemes. This is what the quoted financial fraud analyst thinks is better and Krebs thinks is worth repeating? This should be the main point of discussion here, yet it's brushed off by the advice of a financial fraud analyst? Oh, our industry is fucked and I just lost a ton of respect for Krebs' reporting.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#44

Post by rbranson »

One thing to remember in all of this is that services like OneLogin are likely a huge upgrade in security for their customers. They lower the barriers for moving away from things like shared passwords and poorly functioning in-house SSO setups.

It's easy for a Gartner analyst to sit behind a desk and pontificate about the ultimate-most-secure single-sign-on, but resource constraints are a thing. SaaS SSO is a very reasonable compromise for those who don't have the time, money, or talent to invest in on-premise infrastructure.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#45

Post by sbarre »

danbruc wrote: post #42
sbarre wrote: post #35

Earlier quoted context omitted.

From reading many articles, it seems that OneLogin does have a service called "Password Cache", which sounds to me like a cache for passwords , perhaps for storing credentials to sites that do not have SSO.. See here: https://support.onelogin.com/hc/en-us/articles/201175264-Pas... If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it som…

If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it somehow [...] But not necessarily all of them all the time. The decryption key could be derived from the master password of each user and only kept around while the user is logged in.

That depends on how the service works I suppose. Does a user have to enter a master password when they log into OneLogin, or does an SSO service authenticate them to OneLogin, which then logs them into Twitter/Facebook/etc?

If the latter, then OneLogin has to possess the ability to decrypt the passwords without user input (edit: although I suppose the SSO token coming from the client could be the key? I don't know if that's possible or how that would work - the key would still need to be cached for some period of time post-auth either way I would think)..

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#46

Post by jacquesm »

stcredzero wrote: post #40
sbarre wrote: post #35

Earlier quoted context omitted.

From reading many articles, it seems that OneLogin does have a service called "Password Cache", which sounds to me like a cache for passwords , perhaps for storing credentials to sites that do not have SSO.. See here: https://support.onelogin.com/hc/en-us/articles/201175264-Pas... If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it som…

If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it somehow By storing so many passwords in one system, they made that system a high value target, all while not having the security chops they thought they had. Password vaults should be distributed. This prevents the conglomeration of password secrets that creates a high value target. T…

This is by far the best argument for decentralization of almost anything that is not meant to be public. You probably will lose some of it but at least you won't lose all of it.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#47

Post by brazzledazzle »

danbruc wrote: post #42
sbarre wrote: post #35

Earlier quoted context omitted.

From reading many articles, it seems that OneLogin does have a service called "Password Cache", which sounds to me like a cache for passwords , perhaps for storing credentials to sites that do not have SSO.. See here: https://support.onelogin.com/hc/en-us/articles/201175264-Pas... If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it som…

If they are storing the password and pushing it to the connected service on the user's behalf, then they have to be able to decrypt it somehow [...] But not necessarily all of them all the time. The decryption key could be derived from the master password of each user and only kept around while the user is logged in.

That wouldn't work, at least for a lot of customers, because they authenticate a user based on a chain of trust back to the customer's on-prem Active Directory instance. An agent running on the customer's infrastructure leverages Kerberos/NTLM to authenticate the user then passes a token back to the identity provider. As a result there are authentication flows where the provider never sees the password.

Many providers do have an agent that runs on the AD servers that MitM captures the passwords when the user rotates them but that's a lot more involved to get setup. They could either force use of that AD agent or remove the functionality entirely and force users to manage a password with the service but it would either make on-boarding slow/impossible or really reduce the convenience factor for users. It's something every identity provider would need to do (or be forced to do) because the ones that didn't would steal away all of their customers.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#49

Post by stcredzero »

There seems to be a great need for an Open Source password vault codebase/library that:

    Runs securely cross-platform, including tablets & smartphones
    Can present a great looking UI across all platforms
    Has no licensing issues in proprietary walled gardens
    Can securely support plugins to integrate with webapps
This would enable startups in the personal security space to be able to serve user's needs for tracking their credentials without creating a high value centralized store of sensitive information.

Re: OneLogin: Breach Exposed Ability to Decrypt Data

#50

Post by autotune »

mnm1 wrote: post #43

'Gartner Inc. financial fraud analyst Avivah Litan said she has long discouraged companies from using cloud-based single sign-on services, arguing that they are the digital equivalent to an organization putting all of its eggs in one basket.' So it's better if that single point of failure the company puts all its eggs into is a hacked piece of shit by an engineer who couldn't build a secure login system if his life d…

There are services companies can use as well that offer on-prem, integrated login solutions, not just DIY.
Post reply on HN