Top all-time · #2872
Okta Security
Company blog · sec.okta.com/articlessecurity
Okta Security is the company blog at sec.okta.com, writing about security. Since 2020, 27 different Hacker News readers have linked it 28 times, most often “Okta hackers stole data on all customer support users in major breach”. It is still writing: the last post was on 2026-10-23, and you can follow it by feed.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
HN readers link Okta Security's articles on OAuth token theft, SMS and WebAuthn two-factor authentication, and its breach and incident reports, usually as references in security discussions.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Okta hackers stole data on all customer support users in major breach5 people · 5 mentions · first linked 2023-10-24
- /harfiles4 people · 4 mentions · first linked 2023-10-20
- Okta's Perspective on the Verkada Hack2 people · 2 mentions · first linked 2021-03-11
- /articles/2021/02/stealing-oauth-tokens-open-redirects2 people · 2 mentions · first linked 2024-09-06
- CrimeOps: The Operational Art of Cyber Crime2 people · 2 mentions · first linked 2020-10-13
- Okta warns of credential stuffing attack via residential proxies2 people · 2 mentions · first linked 2024-04-28
What Hacker News says?
> most major websites Is this true? Do you know of any major ones offhand? That would be surprising to me. Thanks for sharing [0]. I found its discussion of shared subdomain cookies useful. However, I believe all the vulnerabilities in the OAuth section would be mitigated by using PKCE and not using the implicit flow, even if you leave the open redirect. Am I missing anything there? As for open redirects in general,…
Comment linking /articles/2021/02/stealing-oauth-tokens-open-redirects
on “OAuth from First Principles”Submitted Okta hackers stole data on all customer support users in major breach as a story · 98 points
HN discussion> Then you can show it to the user so they know exactly where the token is being sent Unfortunately, most major websites end up hosting an endpoint that will redirect users to a separate URL provided as a query parameter. This means that users may easily be misled about where the token is, in fact, being sent. [0] - https://sec.okta.com/articles/2021/02/stealing-oauth-tokens-... [1] - https://datatracker.ietf.org/do…
Comment linking /articles/2021/02/stealing-oauth-tokens-open-redirects
on “OAuth from First Principles”Submitted CrimeOps: The Operational Art of Cyber Crime as a story · 90 points
HN discussionWe know generally where they are, because there are only a few countries that turn a blind eye like this and totally refuse to cooperate internationally. Anything outside their home country's jurisdiction is fair game. Ransomware can be a real boost to a local economy. https://sec.okta.com/articles/2020/08/crimeops-operational-a...
Comment linking /articles/2020/08/crimeops-operational-art-cyber-crime
on “Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage”Submitted Okta warns of credential stuffing attack via residential proxies as a story · 3 points
HN discussionNot to pile on but this is just one of the many reasons why SMS is bad for 2FA. https://sec.okta.com/articles/2020/05/sms-two-factor-authent...
Comment linking /articles/2020/05/sms-two-factor-authentication-worse-just-good-password
on “Ask HN: Carrier “lost” my number in a port request”Submitted Unauthorized Access to Okta's Support System: Root Cause and Remediation as a story · 3 points
HN discussion...which has effectively neither adoption not momentum to achieve adoption: https://sec.okta.com/articles/2020/04/webauthn-great-and-it-... For better or worse, there are a large (and ever growing) number of Metamask users these days...
Comment linking /articles/2020/04/webauthn-great-and-it-sucks
on “Real Problems That Web3 Solves, Part 1”Submitted How to Block Residential Proxies Using Okta as a story · 2 points
HN discussionFunny how this article points that Okta was notified by a third-party of suspicious tenant activity, Okta did not find evidence of the breach, and only after some persistence from BeyondTrust did Okta re-investigate and identify the breach. Okta published a blog post here: https://sec.okta.com/harfiles and kicks it off with > Okta Security has identified adversarial activity and no mention of the notification from t…
Comment linking /harfiles
on “Hackers Stole Access Tokens from Okta's Support Unit”Submitted WebAuthn Is Great and It Sucks as a story · 2 points
HN discussionGood question. From their incident report yesterday it looks as though Okta started by blaming the victims, taking half a month to realize Okta itself was the problem. Then they clamped down on Chrome's automatic exfil of company credentials. https://sec.okta.com/harfiles That feels narrow. What seems evident, but not addressed, is their initial reaction of victim customer blaming, the identification of suspicious b…
Comment linking /harfiles
on “Okta hit by another breach, stealing employee data from 3rd-party vendor”Submitted Official Okta Statement on Lapsus$ Claims as a story · 2 points
HN discussionThe market has correctly observed that it wasn’t Salesforce who screwed up, it was their customers. Okta came out and said they were not compromised, despite being targeted.[0] I assume this is because they did some hardening on their unnamed “support case management system” last time they got popped.[1] [0] https://cyberscoop.com/okta-zscaler-security-leaders-saleslo... [1] https://sec.okta.com/articles/2023/11/una…
Comment linking /articles/2023/11/unauthorized-access-oktas-support-case-management-system-root-cause/
on “Salesforce refuses to pay a ransom in recent wave of attacks”Submitted Common Pitfalls of Custom SAML Implementations as a story · 2 points
HN discussionThis is about the Nov 3 Okta report https://sec.okta.com/harfiles
Comment linking /harfiles
on “Okta Security Breach: 134 Clients Impacted, Including Cloudflare and 1Password”Submitted Detecting Cross-Origin Authentication Credential Stuffing Attacks as a story · 1 points
HN discussionThere were 3 known customers targeted. >BeyondTrust reported the issue. All 3 customers discovered the issue before Okta fixed the issue. I think all 3 reported the issue to Okta before Okta fixed the issue, but I'm not sure. 1Password and BeyondTrust both reported the issue to Okta before Okta discovered the issue (although 1Password wasn't sure whether the cause was a compromise of Okta's support or malware on the…
Comment linking /harfiles
on “1Password detects "suspicious activity" in its internal Okta account”Submitted Octa Security Incident – Update and Recommended Actions as a story · 1 points
HN discussionOkta recently partnered with a few folks to tackle this. They published a thing [1] in April. Fraudulent registrations and bots are being screened using Shape which was acquired by F5 [2]. I'm not saying this problem has been solved, but it's an area of active concentration. For most folks, the offerings are more than adequate. For the top saas or platforms, you'll probably always have this issue as you're a lucrati…
Comment linking /shareddetections
on “So Long, Twitter and Reddit”Submitted Tracking Unauthorized Access to Okta's Support System as a story · 1 points
HN discussionhttps://sec.okta.com/articles/2022/12/okta-code-repositories
Comment linking /articles/2022/12/okta-code-repositories
on “Okta says its GitHub account hacked, source code stolen”Submitted Tracking Unauthorized Access to Okta's Support System as a story · 1 points
HN discussionSubmitted Okta discloses some customer network breaches as a story · 1 points
HN discussionSubmitted A CSO’s perspective on the recent Verkada cyber attack as a story · 1 points
HN discussionSubmitted Okta's Perspective on the Verkada Hack as a story · 1 points
HN discussionSubmitted KPop Fans: Non-Traditional, Non-State Actors as a story · 1 points
HN discussion
