News for hackers. Stuff that matters.

A comment on Everything authenticated by Microsoft is tainted. Parent comment

Re:Everything authenticated by Microsoft is tainted by Muromec on Friday September 29, 2023 @08:23AM (#37702792)
The worst part of the story to me is —- those were not even the right keys, those were something issued to a client and scoped, but scoping check was broken. It’s unbelievably bad all around
[ Parent | on HN ]
Re:Everything authenticated by Microsoft is tainted by ShadowRegent on Friday September 29, 2023 @08:27AM (#37702894)
Close, but not quite. The keys were for consumer Microsoft accounts, but accepted for organization accounts as well.
[ Parent | on HN ]
Re:Everything authenticated by Microsoft is tainted by styx31 on Friday September 29, 2023 @08:40AM (#37703120)
Only if your app was registered to accept both mixed organization and MSA account, which is not a default option.
[ Parent | on HN ]