Comment by eastbound
21 hours ago
Just upvoting to emphasize that Okta, SSO and MDM services in general are an extremely major single point of failure. From the point of view of a non-expert in security, it would seem like segmenting the authentication services of companies should be a security requirement.
Dunno why you’re downvoted. You’re not wrong.
Trusting an SSO system, or anything with security sensitive data on the public internet presents an attack surface with untenable risk when your adversary is thousands of people with LLM tools.
It’s going to take a lot of this before people realise using someone else’s computer is a pretty fucking stupid idea.
I mean Entra and Okta got popped. That should have been the point companies looked at this risk and went nope.
Didn't Okta had several major hacking incidents over the last decade as well?
> Didn't Okta had several major hacking incidents over the last decade as well?
Yes [1].
[1] https://www.flyingpenguin.com/a-simple-list-of-the-many-okta...
First, SSO is often non-negotiable. Otherwise employees spend a huge chunk of their working day just logging into different services.
Second, too complicated security setups often result in trivially hackable global passwords and shit like that because turns out, there are very few people willing to daily rotate and remember 30 different cryptographically random 256-bit arrays.
Third, no matter how robust your security setup is, there will always be someone who finds a flaw in it, so a much better solution is to just do bare minimum and get insurance.
It's strange to be that so many security experts are completely detached from how humans actually act.
> Otherwise employees spend a huge chunk of their working day just logging into different services.
Instead they spend a huge chunk of their day logging into different services through a redirect via an SSO site. They don't have to have their password manager fill in new passwords each time. IME it doesn't actually save any time.
The advantage of SSO is the organization can ensure everyone is using the same security config. They can enforce a minimum password length for SSO. They can enforce 2FA for the SSO provider. Etc.
That's a new thing. And it's worse now than it ever has been.
When we had local, properly integrated AD no one had to log into anything other than their computer.
The whole SSO / SAML thing is a huge regression in usability.
Both are true, it is a single point of failure and a single point of convenience.
What always puzzles me about this stuff and critical infrastructure like nuclear powerplants, is why is an internal network connected to the public Internet at all?
If you have to connect it to the Internet, then why is it talking to unknown devices?