News for hackers. Stuff that matters.

A comment on Okta’s Investigation of the January 2022 Compromise. Parent comment

Re:Okta’s Investigation of the January 2022 Compromise by kasey_junk on Wednesday March 23, 2022 @08:17AM (#30777648)
Why is it a meaningless distinction to prevent account creation but allow password reset?

Most commercial services allow unauthenticated password reset just by hitting a web form. It would send a password reset link to the correct place and the person would either ignore it, follow through and have a new password or report it. It doesn’t impact the service access at all.

Meanwhile creating an account would allow new access to the system. I’m having a hard time figuring out how that’s not a world of difference?

[ Parent | on HN ]
Re:Okta’s Investigation of the January 2022 Compromise by sascha_sl on Wednesday March 23, 2022 @09:59AM (#30778523)
Apparently the "password reset" is more of a "password set" feature.
[ Parent | on HN ]
Re:Okta’s Investigation of the January 2022 Compromise by kasey_junk on Wednesday March 23, 2022 @10:02AM (#30778540)
Where was that outlined? All of the screen dumps I saw showed what looked like a reset.
[ Parent | on HN ]