Re:Hackers used Slack to break into EA Games
by josho on Friday June 11, 2021 @05:08PM
(#27478523)
In my opinion you don’t. Rely on the authentication provider to handle that responsibility. Services like duo/Okta perform this risk assessment and may opt to request a mfa request.
[ Parent
| on HN ]
Re:Hackers used Slack to break into EA Games
by bradleydwyer on Friday June 11, 2021 @05:37PM
(#27478814)
I've never wanted to completely hand over authentication to a third-party.
Instead what I'd think I'd like is just the risk assessment to be be performed by a third-party when I'm handling authentication (i.e. a third-party that has a broader view of what's happening across multiple services over time). I just send the pieces of information that I'm willing to share as an API call and they make the best risk assessment they can.
Then I can take that risk assessment result and make a final decision if authentication succeeds or not.
Re:Hackers used Slack to break into EA Games
by jsmeaton on Friday June 11, 2021 @06:45PM
(#27479424)
There are risk services out there.
https://sift.com/ Is one you call out to that gives you a risk score.
https://datadome.co/ can sit within your cdn layer that does risk assessment.
That's not always an option.
You can downvote all you want. Some projects are sensitive enough to not allow third party authentication (military systems anyone).
Besides, if you're large enough it makes business sense to do it yourself anyway.