Hacker News Reader

Comment by ryanisnan | Hacker News Reader

What a misleading and click-baity title choice by Ars Technica.

This had nothing to do with Okta's platform, as implied. A third-party Vendor Okta used for health insurance information was breached, and personal information on Okta employees was stolen.

I'm disappointed in Ars Technica, and Dan Goodin.

edit: Updated to be more specific about what part of Okta this had nothing to do with.

View on HN

https://www.rightwayhealthcare.com is the company mentioned in the article. Okta is shown as a customer on the website, and the company's marketing says "Our members love using Rightway". There is zero mention of security on their website that I see, but the website is entirely marketing and self-congratulatory. I would expect that other Rightway customers were likely also affected, but they had no comment mentioned in this article so how wide the breach was is unknown. Okta is a well-known company so that's why this article focused on them, which is not the real story, but I guess like you said clickbait.

Okta is promoting Rightway as a benefit of Okta: https://rewards.okta.com/us/healthcare/medical/rightway-heal...

ARS commenters seem to have created a very specific kind of echo chamber and they guard it passionately, fiercely rebuking any and all dissenting opinions into oblivion. Sadly, ARS writers seem motivated to cater these folks' predilections. Sometimes it seems like they write articles with little purpose other than to provide grist for their beloved mob's mill. Perhaps these journalists are rewarded for 'high audience engagement.'

So glad HN hasn't devolved into that. Gratitude to the mods here.

Okta (or any company) can't outsource its responsibility when it outsources to a supplier.

If Okta printed all that personal data and left it in a box on the street they would be liable.

Ok, but that's not what the article says. It says Okta was breached. Okta was not breached.

It says Okta was "hit by" a breach, which it was. A breach happened, and Okta was impacted. Furthermore, it happened to data which Okta is ultimately responsible for, and Okta should be held responsible for their choices which led to their employees' data being stolen.

I'm not sure why you're splitting hairs on this.

"another" is the weasel word

It implies this breach is the same as the previous breach, which it's not.

Ars has gone to shit over the last decade.

I don't think I agree that the use of the word "another" implies that the breaches were equal, but I can see why others might interpret it that way.

I won't disagree with opinion on the quality of Ars' reporting or this particular article, but I do disagree with the original comment's statement that "this had nothing to do with Okta".

Without knowing the context, I doubt anyone reading the title is thinking "maybe they mean another breach where Okta is impacted but Okta is not the culprit, despite recent events". No, the title is simply misleading. They could have swapped Okta for another company's name or something like "Personal information stolen in healthcare company breach", and the news likely wouldn't get much attention, which is as much as what the article is actually worth. Singling out Okta among many of that company's clients is simply meaningless and wrong and does nothing other than attention grabbing.

Immediately what I thought when I read it.

The person you’re responding to is being obtuse to the point where it feels like trolling or contrarianism for the sake of contrarianism. Certainly a bad-faith argument.

> but I do disagree with the original comment's statement that "this had nothing to do with Okta".

I could have probably phrased this as "this had nothing to do with Okta's technology."

Because context and sentiment matters. By your logic clickbait is perfectly fine and we should maybe do more because they are (usually) technically correct.

Just continue reading the title all the way to the end? I know it's a long haul but come on, we can't just stop at the first bit of punctuation:

> Okta hit by another breach, this one stealing employee data from 3rd-party vendor

It's clear a breach has affected Okta employees.

It says Onta was hit by a breach, Okta was hit ny a breach, it even says that is was a third party vendor. That's exactly what happened.

The problem is the article is farming clicks by piggie backing off of the very recent and public breach Okta had. I don't know if there's a term for this, but it's clear to me they're abusing oktas name.

Re-read the above comment.

Okta the company had a breach.

Okta the platform did not.

Employee data vs customer data

Thanks. I've belatedly changed the title above.

Maybe someone is short selling.

The truth is usually less exciting.

Someone(s) almost certainly (are), not necessarily relatedly (to the article, to the breaches, yeah absolutely), what a pointlessly vague thing to say.

The concept of journalists trading on the news they break is coincidentally making waves right now with this new startup called Hunterbrook[^1]. I assume that outright misleading headlines won't be something they'd risk, but it's an interesting concept, since, yeah normally this is something you'd accuse someone of, and not expect that to be the whole point.

[^1]: https://www.ft.com/content/3c861c6c-87be-459d-b62f-b44bf2d75...

Honestly Ars has really fallen in the past few years.

Reply on news.ycombinator.com