News for hackers. Stuff that matters.

A comment on Okta’s Investigation of the January 2022 Compromise. Parent comment

Re:Okta’s Investigation of the January 2022 Compromise by sascha_sl on Wednesday March 23, 2022 @06:21AM (#30776924)
From circulating screenshots, and the omission in the listing here, it looks like they used this account to reset user passwords and MFA on a bunch of tenants. Not being able to create or delete users is meaningless.
[ Parent | on HN ]
Re:Okta’s Investigation of the January 2022 Compromise by kasey_junk on Wednesday March 23, 2022 @08:17AM (#30777648)
Why is it a meaningless distinction to prevent account creation but allow password reset?

Most commercial services allow unauthenticated password reset just by hitting a web form. It would send a password reset link to the correct place and the person would either ignore it, follow through and have a new password or report it. It doesn’t impact the service access at all.

Meanwhile creating an account would allow new access to the system. I’m having a hard time figuring out how that’s not a world of difference?

[ Parent | on HN ]
Re:Okta’s Investigation of the January 2022 Compromise by sascha_sl on Wednesday March 23, 2022 @09:59AM (#30778523)
Apparently the "password reset" is more of a "password set" feature.
[ Parent | on HN ]
Re:Okta’s Investigation of the January 2022 Compromise by kasey_junk on Wednesday March 23, 2022 @10:02AM (#30778540)
Where was that outlined? All of the screen dumps I saw showed what looked like a reset.
[ Parent | on HN ]
Re:Okta’s Investigation of the January 2022 Compromise by yibg on Wednesday March 23, 2022 @10:30AM (#30778804)
Why is password reset considered a big issue? If I know your email / login I can go reset your password for a bunch of stuff now without any breach.
[ Parent | on HN ]
Re:Okta’s Investigation of the January 2022 Compromise by h0l0cube on Wednesday March 23, 2022 @07:21AM (#30777286)
Fair call. That's an important clarification.
[ Parent | on HN ]