Re:Updated Okta Statement on Lapsus$
by ricardobeat on Tuesday March 22, 2022 @04:07PM
(#30770847)
I don't understand all these crazy assumptions being made. A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case. Especially for a security company. It would be the equivalent of giving the doorman a key that opens everyone's apartment. Obviously support can trigger a reset, that you have to complete from your own e-mail account.
[ Parent
| on HN ]
Confusing analogy, doormen frequently do have a key to every apartment in the building.
Anyway I agree it would be bad practice but that doesn't mean it's not done.
Re:Updated Okta Statement on Lapsus$
by ricardobeat on Tuesday March 22, 2022 @04:24PM
(#30771036)
> doormen frequently do have a key to every apartment in the building
Really? That's insane. I'd like to hear more about that.
I've actually had a landlord give the keys to one of the tenants since they didn't have a doorman. The tenant in question was actually a registered sex offender too, but the judge is friends with the landlord so no harm done. Crazy world.
> A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case
I have no idea what an Okta support engineer can or can't do but I know that a regular account administrator can set an arbitrary password for a given user via the Okta UI.