Hacker News Reader

Comment by hangonhn | Hacker News Reader

> but most people I know in security have always had a poor view of Okta's security.

What are their usual criticisms? Genuinely curious. I've always hated their UI, their docs, and lack of real support but felt that at least they had security going for them. The last assumption might have been proven wrong tonight.

Also, what would be a reasonable alternative to Okta now that their nearest competitor, Auth0, was acquired by them. Is GSuite a reasonable alternative for SSO with multiple different providers and supporting SAML, etc.? Thanks in advance.

View on HN

A problem in infosec is information dissemination. Lots of their criticisms are based on backchannel information shared over drinks. It makes it difficult to discuss publicly.

I wouldn't want to make a recommendation, but I'll say that my company uses GSuite.

A typical opsec issue in many companies even to this day is doing ssh shell access to critical systems and doing so with ldap passwords or user-controlled authorised keys and without 2FA and without host key verification. There are trivial browser based local network attacks to gain reverse shell access with such setups. Just because those systems are behind firewall and VPN, people tend to falsely believe they are more secure.

> or user-controlled authorised keys and without 2FA and without host key verification. There are trivial browser based local network attacks to gain reverse shell access with such setups.

I'm struggling to see how that attack works without a copy of the private key.

Any pointers for what to search for to understand this better?

The key thing here is _user controlled_ private keys: this means that those can leak, and if they leak, you're in trouble.

A better solution is to use ephemeral SSH keys generated using an SSH CA. This kind of thing can be implemented with Hashicorp Vault, though I'm sure there are plenty of other solutions out there.

It simplifies key checking on servers too, as they just need to the details of the signer and there's no need to juggle keys in LDAP.

You'll still need a way to deliver those ephemeral ssh keys to a user controlled location, or make them indirectly usable by users (which amounts to the same thing).

In my company, we have a wrapper around `ssh` that handles that. That's the easy bit.

Jumpcloud seems to work quite nicely.

Reply on news.ycombinator.com