News for hackers. Stuff that matters.

A comment on Updated Okta Statement on Lapsus$. Parent comment

Re:Updated Okta Statement on Lapsus$ by chockchocschoir on Tuesday March 22, 2022 @02:40PM (#30769796)
The text is a bit ambiguous (and probably on purpose, I'm sure it passed through multiple layers where multiple lawyers have reviewed it too). Okta says Lapsus$ were unable to "obtain" the passwords, but they didn't say they were unable to set their own passwords (for example). Neither is the MFA tokens mentioned, although they do mention MFA in the text.
[ Parent | on HN ]
Re:Updated Okta Statement on Lapsus$ by creativenolo on Tuesday March 22, 2022 @02:52PM (#30769943)
Then they'd have obtained it, no?

It seems pertinent a support engineer could trigger a password reset if they were worried a password had been compromised for a user.

[ Parent | on HN ]
Re:Updated Okta Statement on Lapsus$ by baobabKoodaa on Tuesday March 22, 2022 @04:05PM (#30770825)
> Then they'd have obtained it, no?

If you change a password, then you didn't "obtain" the previous password. Weasel words but there you go.

[ Parent | on HN ]
Re:Updated Okta Statement on Lapsus$ by sodality2 on Tuesday March 22, 2022 @03:55PM (#30770691)
I think "obtain" here is specifically meant to mean "get existing passwords in plaintext", not "get a valid password via resetting it to a known one".
[ Parent | on HN ]