Abusing Entra OAuth for fun and access to internal Microsoft applications

Re:Abusing Entra OAuth for fun and access to internal Micros... by raesene9 on Sunday August 10, 2025 @03:32AM (#44853449)

It doesn't have to. There's nothing to stop you using a VPN as an initial filter to reduce the number of people who have access to a network and then properly authenticating and authorizing all access to services after that.

In fact, I'd say is a good defence-in-depth approach, which comes at the cost of increased complexity.

[ Parent | on HN ]

Re:Abusing Entra OAuth for fun and access to internal Micros... by nicce on Sunday August 10, 2025 @07:52AM (#44854579)

It also prevents the whole world for scanning your outdated public interfaces. Before they can do that, they need to bypass VPN.

If there are tens of different services, is it more likely that one of them has vulnerablity than both VPN and service has? And vulnerability in VPN alone does not matter if your internal network is build like it is facing public world. You might be able to patch it before vulnerability in other services is found.

[ Parent | on HN ]

Re:Abusing Entra OAuth for fun and access to internal Micros... by tw04 on Sunday August 10, 2025 @10:29PM (#44860278)

I’m not saying you can’t have your own definition.

But I am saying that a VPN isn’t zero trust, by the agreed upon industry definition. There’s no way to make a VPN zero trust, and zero trust was created specifically to replace legacy VPNs.

[ Parent | on HN ]