Hacker News Reader

I don't understand all these crazy assumptions being made. A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case. Especially for a security company. It would be the equivalent of giving the doorman a key that opens everyone's apartment. Obviously support can trigger a reset, that you have to complete from your own e-mail account.

View on HN

Confusing analogy, doormen frequently do have a key to every apartment in the building.

Anyway I agree it would be bad practice but that doesn't mean it's not done.

> doormen frequently do have a key to every apartment in the building

Really? That's insane. I'd like to hear more about that.

I've actually had a landlord give the keys to one of the tenants since they didn't have a doorman. The tenant in question was actually a registered sex offender too, but the judge is friends with the landlord so no harm done. Crazy world.

> A support engineer being able to set a password on any account is unthinkable, there is zero chance this is actually the case

I have no idea what an Okta support engineer can or can't do but I know that a regular account administrator can set an arbitrary password for a given user via the Okta UI.

Reply on news.ycombinator.com