Hacker News Reader

Comment by jgrahamc | Hacker News Reader

Lots more detail: https://blog.cloudflare.com/cloudflare-investigation-of-the-...

How is that lots more details ? Your post is only about whether or not CF Okta account has been compromised not about what really happened for all Okta customers

it has more detail on the breach then okta's own statement.

They give more technical details than the Okta post and probably even the Okta customer contact.

Eg.

> Cloudflare reads the system Okta logs every five minutes and stores these in our SIEM so that if we were to experience an incident such as this one, we can look back further than the 90 days provided in the Okta dashboard. Some event types within Okta that we searched for are: user.account.reset_password, user.mfa.factor.update, system.mfa.factor.deactivate, user.mfa.attempt_bypass, and user.session.impersonation.initiate. It’s unclear from communications we’ve received from Okta so far who we would expect the System Log Actor to be from the compromise of an Okta support employee.

the difference in level of detail and amount of information provided has been out of this world. Thank you!

Also a fun exercise in "Show don't tell" when it comes to transparency.

Okta writes "We are deeply committed to transparency" but shows none in their blogpost in contrast to CloudFlare, that doesn't write anything about transparency but displays a lot of it.

A bit like queuing for your internet providers customer support for 3 hour and hearing "We care about customer satisfaction" every five minutes.

I thought that a CF person (can’t remember if it was Prince or not) said in the main HN thread yesterday, that CF uses their own homegrown SSO internally, and Okta externally, but this blog article seems to infer the opposite…

Anyway, I likely misinterpreted yesterday’s comment..

I think you're referring to this tweet:

https://twitter.com/eastdakota/status/1506148082194386949

I believe @eastdakota is saying that Cloudflare has their own homegrown SSO internally, but they do not make that available externally to their customers (it's not a public product that one can buy). I don't think that the tweet was saying that they use Okta externally.

I gotta say, I don't make technical decisions at the "we're using CF" level, but I've been incredibly impressed with their track record over the years. I often evangelize blog post writing and transparency at my company and this is exactly why. What a way to build trust. It's basically free advertising for technical folk by "putting their money where their mouth is."

I'd love to see more of this in the industry. CF is, IMO, industry leading here.

Their blog posts are great, but for a service where reliability really really matters, they've had a few too many global outages.

Especially considering their core proxying service doesn't have any requirement for a globally consistent datastore, there is zero excuse for a global outage.

> doesn't have any requirement for a globally consistent datastore

How do you think they manage configuration for proxying millions of customer websites? Using a globally distributed data store.

> Suspend the one Cloudflare account visible in the screenshots

As far as I can see, there's a lot of cloudflare accounts visible in the screenshots shared by the group. Stuff like cloudflaretv1, etc..

Sorry. Should have been clearer. There’s a screenshot showing a password reset about to happen for a specific person. We suspended that account. In parallel, we were using our own logging to look for any password reset/MFA change over the last four months and just went ahead and forced a reset for all those users.

Reply on news.ycombinator.com