Okta’s Investigation of the January 2022 Compromise

Re:Okta’s Investigation of the January 2022 Compromise by socks on Wednesday March 23, 2022 @06:14AM (#30776885)

At my own workplace (a SaaS service), we cannot change passwords, we can only send reset links (and the reset email goes to the end user).

I can't see any place in the screenshots where they are setting a user's password, only sending reset links (which would do nothing if the support user does not have access to system email or end users email).

Also at my workplace, 2FA is not enforced by an IdP (like Okta), but by our own application (and therefore could not be disabled at the IdP level).

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by adrr on Wednesday March 23, 2022 @11:10AM (#30779256)

How do you send a reset password email with a SSO platform that gates email?

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by oneweekwonder on Wednesday March 23, 2022 @03:37PM (#30782374)

If you have 2FA a OTP can be sent to a trusted device or app to allow a password reset without having access to email?

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by ctvo on Wednesday March 23, 2022 @07:54AM (#30777506)

Is your workplace Okta? They built a custom internal tool. Until they enumerate exactly what the attacker had access to it’s hard to infer anything.

[ Parent | on HN ]

Re:Okta’s Investigation of the January 2022 Compromise by sb8244 on Wednesday March 23, 2022 @08:44AM (#30777856)

The article specifically addresses this, right? They log every interaction from support engineers and are going to report to the affected customers what actions were performed.

As others have mentioned, the slack access is potentially more concerning.

[ Parent | on HN ]