News for hackers. Stuff that matters.

A comment on A Pentester's Guide: Osint, Breach Dumps, and Password Spraying. Parent comment

Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by tptacek on Wednesday April 10, 2019 @02:47PM (#19627621)
It's also a reason we generally push everyone to centralize authentication on an SSO provider like Okta or Google Cloud Identity, both because those platforms allow you to easily set policy requiring 2FA, which breaks the attack, and because OIDC and SAML let you log into lots of services without exposing each of them to account takeover independently.

There are other good reasons to do this, too.

At Black Hat last year, I cornered a bunch of CSO-types at big startups and asked for what their first 3 initiatives would be, and this was something I heard a bunch.

You should have some kind of SSO set up, early.

[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by kasey_junk on Wednesday April 10, 2019 @03:30PM (#19627983)
Do you mean that your application you 'write' should support SSO early or that the applications you 'use' should?

That is are you talking about integrating your product with SSO or integrating your IT systems?

[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by tptacek on Wednesday April 10, 2019 @03:32PM (#19627998)
That, too! Especially if you have support personnel interacting with in-house applications, though putting those behind a VPN also goes a long way towards preventing account takeover on those applications.

But in general, the idea is that you want an SSO early so all the random SAAS applications you subscribe to can have a coherent security policy.

[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by joeyrideout on Wednesday April 10, 2019 @09:48PM (#19630440)
100% agree. Fewer auth providers (ideally, one) greatly reduces the work involved with mitigating this attack (and maintaining permissions, auditing, passthrough... everything gets easier, really).

Happy Okta client here.

[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by Bombthecat on Wednesday April 10, 2019 @06:39PM (#19629436)
A colleague is currently implementing okta.

As far as I heard it is a ton of work and very complicated. (they can't use saml, they use oauth)

[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by joeyrideout on Wednesday April 10, 2019 @09:52PM (#19630466)
From my experience, anything SSO-related has a steep learning curve in wrapping your head around IDP, SP, metadata, IDP-initiated vs. SP-initiated... there's a whole lexicon that isn't very intuitive. Ask me to set it up a year ago and I would have described it as "a ton of work and very complicated". Eventually it stuck, though :)

Okta client here btw, and we use SAML (2.0) for many of our SSO integrations. Okta has pretty clear support for SAML 2.0. Maybe your colleague's app is a special case?

[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by Bombthecat on Wednesday April 10, 2019 @11:22PM (#19630896)
Nope, not at all. He knew all those words and more (he is basically an oauth expert)

He said the biggest problem is how okta handles user information, roles, rights and how it is stored. He said, that they have there own idea about it. (which can be good or bad...) didn't dig deeper though :)

[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by mc32 on Wednesday April 10, 2019 @03:51PM (#19628168)
What do you about providers who while they support SAML keep the front door open after setting up trusts?
[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by Kalium on Wednesday April 10, 2019 @04:05PM (#19628279)
You feed your strong preference for SSO into procurement, which can really help cut down on the number of such vendors.
[ Parent | on HN ]
Re:A Pentester's Guide: Osint, Breach Dumps, and Password Sp... by spydum on Wednesday April 10, 2019 @09:19PM (#19630285)
Front door accounts should be vaulted away for when SSO is broken only.
[ Parent | on HN ]