Re:OneLogin: Breach Exposed Ability to Decrypt Data
by yzmtf2008 on Friday June 02, 2017 @02:40AM
(#14467945)
Think about a single-sign-on service: by definition, the service would have the ability to generate/access tokens that would grant a user access to other applications. Therefore, a breach in any kind of SSO service would result in granting access to people's information -- no decryption needed!
[ Parent
| on HN ]
Re:OneLogin: Breach Exposed Ability to Decrypt Data
by vidarh on Friday June 02, 2017 @03:20AM
(#14468103)
That's true, but the SSO service itself can run on the users computer, so there is no need for the service to be able to decrypt the users data, only for it to be able to persist encrypted data.