Auth companies are high value targets for hackers. You'd think outsourcing auth is a smart idea because it's difficult to get auth right but otoh you might never have been a target if you hadn't used Okta.
How is it difficult to get web application authentication wrong at this point? It’s super well tread territory. Add your spices, a sprinkle of cookie crumbs, a token here or there, and then 2 hours in the oven and you’re done!
And that’s rolling it entirely by hand. Most web frameworks have middleware that get you going in minutes.
Adding a log in to an app is no big deal but there are more complex scenarios to consider. Maybe single auth to multiple services, SSO, 2FA, OTP, Oauth, etc.
It's not a satisfying answer, but none of this will change until the public feels so strongly about this problem they become single-issue voters electing legislators to pass radically different laws.
Implementing an auth flow to specification isn't trivial at all and that is a problem. Authn and authz get mixed up, people not checking tokens or their expiration, etc pp. There is probably a minefield of security issues here and some of those come to be because it is too complicated.
Sure, there is middleware with sensible service integration, but you still need to do a lot of legwork in any case.
MSPs have to be one of the juiciest targets, and recent history would indicate that they are.
https://www.bleepingcomputer.com/news/security/heroku-admits...
https://therecord.media/managed-service-providers-cyberattac...
https://darknetdiaries.com/transcript/103/
> This is an interesting story since the threat actor targeted MSPs to go after their customers and then carry out their objectives from there. MSPs are pretty common. More and more companies are outsourcing their IT infrastructure, so to target them makes a lot of sense if your goal is to steal intellectual property. It’s sort of like going after the janitor’s key ring which can get you access into many buildings in town.