Okta Personal
oktapersonal.com
oktapersonal.com
https://www.theverge.com/2022/4/20/23034360/okta-lapsus-hack...
https://techcrunch.com/2022/12/22/okta-breach-source-code-gi...
https://www.malwarebytes.com/blog/news/2023/01/okta-breached...
(IAM is a component of my work)
1. In the first hack, if anything Okta over communicated about the hack: the hack ended up being much less severe than they originally said was possible, and, from a security perspective, the hack didn't really have any negative consequences to customers.
2. Your second 2 links are about the same issue, which was a breach of their GitHub accounts. Again, it's worrisome that someone could find vulnerabilities in their source code, but no customer data was compromised.
You're free to think what you want about the severity of these hacks (I personally think they're low), but I don't see how you could have problems with "how they dealt with it each time". They seemed to have textbook correct incident response communications - what else would you suggest they had done?
Also, given the nature of the breaches, I don't think they point to severe security culture problems at the company (in contrast, for example, to the LastPass and Solarwinds breaches, which showed all the signs of clown show security culture IMO).
The fact that they think the personal market is lucrative enough to break into while already being successful in the enterprise makes me sad that 1Password couldn’t be content with the personal market and instead decided it was enterprise or bust, much to the chagrin of many of their personal client base.
I believe that 1Password has grown significantly in the professional space, and that Okta likely sees this trend as a competitive threat.
If there's anything that Apple's upending of Blackberry taught us, it's that all you need is a one key decision maker in an entire organization to say "wait, why can't I use {product x}?" for that organization to slowly move away from the entrenched enterprise solution. The fact that Okta is joining the consumer space validates 1Password's decision to creep into the enterprise market.
Does anyone love it? I buy it but it seems really expensive and not a fantastic UX. It’s weird how expensive and complicated this is and I’m surprised there aren’t more competitors because the cost should be rather low.
The think that’s annoying to me is the price is $2-11/user/month for sso. That’s crazy considering orgs have thousands of employees that need this and previous self-hosted solutions from CA and others were $50-100k for unlimited accounts.
And this seems like an odd place per user and it costs similar amounts to support 1000 users as 5000.
(Also accounts with user counts that high aren’t paying MSRP you see)
Microsoft should be including sso in their baseline/free products and all enterprise and wanna-be-enterprise software should put it in its base tier.
Logon security shouldn't be tucked behind a paywall or held hostage as a bonus quadruple the price feature, because breaches have wide reaching consequences past just the company attacked going down.
I would like to add that configuring Azure AD as an SSO provider is available to any tenant free. Some of the functionality like Conditional Access does require paid licensing.
I’m aware of a number of businesses that are very happily using Keycloak in production. Not everyone can, although there is RH SSO if you need the support contract.
Then there’s Gluu, Authelia, and many others depending on your needs.
Sadly even with basic security we can’t seem to fully trust our own vendors to have our interests at heart.
All in all this is a pass from me because I don't believe Okta are focused enough on their end users. Too guided by the critical mass that exists at the top.
https://www.godaddy.com/whois/results.aspx?domain=oktaperson...
Specifically the following page links to oktapersonal.com: https://support.okta.com/help/s/okta-personal/using-okta-per...
More than a few on the Fortune 500, for example.
Also turns out being PiMP certified has brought in tons of money, which my wife was against until I showed her the statements from our Call Girls (1099 contractors)
What about the front yard basketball hoop. You should be renting that from a local startup, not capitalising all that plastic.
despite the chatgpt reference, it appears to be a legitimate marketing domain for okta.
https://support.okta.com/help/s/okta-personal/using-okta-per...
No links found on okta.com. Altough of course signing up on personal.okta.com is safe (as safe as it is to use okta anyways, they don't have the best track record exactly)
Naming conventions like this really trigger my phishy senses.
It's made trust so much harder to establish, and completely ruined any sort of ability to educate others on how to read urls.
Even local governments have moved to citystate.gov instead of city.state.gov.
Cool tool but a bit late, I think. Maybe if it were earlier before the M1 when 1Password and LastPass would freeze the page.
I don't think I love anything from work, much the same way most McDonalds fry cooks probably aren't particularly smitten with the spatula at their restaurant's grill. But of all the things I regularly interact with at work, Okta is probably the thing I love the least since it signs me out 8+ times a day and bounces me through an unholy amount of redirections every time I click on a "chiclet" all in the name of "security".
If I was still having to track my time, I would genuinely have to log a ticket each day for dealing with Okta with the amount of time it sucks up.
IE, not actual Okta-proper that’s IDP doing SAML or OIDC auth?
Biometrics? Bring it on: Why Okta’s Jameeka Green Aaron wants passwords to go away
https://www.theverge.com/23850354/biometrics-breaches-okta-j...
As a security and privacy pro, my own social login footprint is too small to use it, but making products for security people is useless anyway. Someone had to solve this, and a secure portal for app logins also owns the channel. The main risk is that vendors will see their flows being interdicted and sabotage the app, that's how good this is, imo.
(Sign up requires SMS confirmation)
Feel like they should have rebranded and just launched a separate product.