Hacker News new | past | comments | ask | show | jobs | submit login
New documents for the Okta breach (twitter.com/billdemirkapi)
151 points by intunderflow on March 29, 2022 | hide | past | favorite | 65 comments



Note he also says he was fired for not taking these tweets down: https://twitter.com/BillDemirkapi/status/1508610588200607746


After the tweets are out there, seems prudent to me to take them down to keep your job? Maybe reach out to someone and tell them to preserve the data before you delete it? Zoom:"We don't like these tweets, delete them or you're fired." Bill:"Ok." Other Person:"Seems Bill took down the tweets, but here's the same info."

Bill obviously begins looking for a new job, and probably gets a raise, due to market conditions, anyway.


Maybe it was: “Zoom: Take these down; Bill: No, I am within my rights as this has nothing to do with my Job; Zoom: OK you are fired”


Why would Zoom care if you posted stuff about another company?


Related:

I have been terminated from Zoom for refusing to remove the following tweets - https://news.ycombinator.com/item?id=30842186 - March 2022 (123 comments)


Non-American here, what is 'at will state'?


It means the employee can leave, or be terminated, for any reason without legal repercussions in that state.


>It means the employee can leave, or be terminated, for any reason without legal repercussions in that state.

Just to be clear, for any LEGAL reason. "At-will" in no way negates statutory rights such as anti-discrimination law or refusal to commit illegal acts. Retaliation against certain protected acts is forbidden. Also, like almost everything under state law there is significant variety even within a given category. There are many states which are at-will overall but also have state level exceptions for things like public policy (this is where whistle blowing can fall under, though that involves some complicated questions too), implied covenants, etc. Finally, at-will is just a legal default, someone could still negotiate a contract that required some different higher level of cause.

So as always, need to consult the specific state law and contract in question unless it's a clear violation of something federal like the Civil Rights Act.


Honestly that just seems crazy. Unless management/HR are stupid, how exactly do you prove you were let go because of X protected thing instead of Y? You hope they settle out of court? And of course, not everyone will have the time or resources for a potentially multi-year legal battle.

That's one of those American things that when you first hear about them, they sound weird/wrong or "okay, why not", but on second thought are just downright crazy and screw over the common people. Like no paid leave by default, even for maternity.


What is your preferred alternative? Make employment itself a right? How do you unload poor performers (who exist in great quantity)? It is already hard enough to do that, given the direct costs of replacing an employee. And what effect would this have on people who are looking for a new job? Companies would have fewer openings, and more reluctance to fill them.


> What is your preferred alternative?

How about the way most of the rest of the civilized world handles it?

Termination must have a cause, be backed up with documentation, and ideally display the company's attempts at remediation (i.e. the PIP).


This makes termination more expensive. That adds a risk to every new hire. Which slightly depresses the totally amount of hiring. Or so the argument would go.


> That adds a risk to every new hire

Which is why many countries which have this allow for few months of probation (three months in Czechia) at the start of employment, where either employee or employer can call it off at any time. There are processes by which an employer can fire an employee after this period (failed performance improvement period, and often severance) or where an employee can leave (resignation effective after a contractually required notice period, or earlier on mutual agreement).

It would take a particular sort of person and probably a special contract for a situation where someone is able to resist being fired for an extended period of time. Most people aren't quite motivated or shameless enough to keep that up for long - it's probably the same sort of effort as actually doing the job.


And yet, it works just fine in reality. That hypothetical argument is pure speculation, used to justify a law that's used to mask firing for illegal reasons and threatening employees.

Termination for most companies is expensive. It's why so many US companies still have and use PIPs. They're up against a threat of losing a lot of money, and if they can remediate the employee (it happens a fair bit, I've found), they've saved that money.

To paraphrase a rather decent well and septic guy on TikTok, "I've just put tens of thousands of dollars into this guy's education. Why would I get rid of him?"


> it works just fine in reality

There are multiple equilibria. At-will favors agility.

On the other end of the spectrum we find economies where most of the workforce is informally or short-term employed and where new-firm formation is limited by employers' aversion to hiring and senior employees' reluctance to leave cushy jobs from which it is nigh-impossible to be fired.

> paraphrase a rather decent well and septic guy on TikTok

They are quoting Lee Iacocca.


> agility

Potential agility at the expense of eroding an employees rights and upsetting their equilibrium. IMO - not worth it.

> On the other end of the spectrum we find

Which is not a symptom of requiring a reason for firing someone, it's a symptom of the employer making people irreplacable.

Something that happens today even at-will workplaces.


We can compare against public sector employees.

I think we can see a difference.

It’s not that we don’t end up with “corruption” with at will policies, but it’s better for the economy to have a more dynamic workforce.

As an individual though, of course I’d like to have a guaranteed job, but… I mean then you get government performance.

Yes some people will excel despite the lack of incentive, but most will prefer to just be mediocre and get by —why not? You won’t get in trouble.


Public sector employees tend towards mediocre because the compensation is awful. The only way to attract anybody at all who doesn't entirely suck is to offer some other less tangible perk, like job security.


Not all public sector jobs pay poorly.

However, there is a dynamic where good performance by employee A is frowned upon by the majority of other employees because that will expose their mediocrity. It’s a complaint I’ve heard from a couple of people who’ve worked in the public sector.


> Termination must have a cause, be backed up with documentation, and ideally display the company's attempts at remediation (i.e. the PIP).

In my experience that's exactly how it works already. It's expensive to fire an employee. If I wanted to let someone go, HR would make me prove it was necessary and require the VP to sign off on it. And if the employee in question is known to be a member of a protected class (the biggest one being anyone middle aged or above) and they even speculate about the possibilities of legal action, good luck firing them at all, justified or not.


Not for everybody. Quite specifically, not for the person in TFA.


Which is also how the vast majority of companies in the US, even in At Will states, do it as well with rare exceptions

Mass layoffs often are treated differently but then they come under different laws as well.

but a normal single employee termination, I have never worked for a company that did not have a Performance Improvement Plan process to terminate poor performance


I agree. Which is why I'm advocating for codifying it; especially when the exceptions are using at-will to attack or threaten their employes.


The problem with that is often times "codifying" things with government regulations ends with several orders of magnitude of unintended consequences that often do not improve the lives of the people you are targeting while at the same time making the lives of everyone that do not have the problem today worse by creating similar or other problems for them


Could this happen? Yes. Would it happen? Highly unlikely. Not for something as simple as changing the laws to require a reason and evidence to fire someone.

Now then, a more likely complication would be riders. But that's not a side effect of codifying employment termination requirements, that's a side effect of shitty legislators.

And that? We have some control over that.

And again, we're not talking about some new legislation with no prior art. It's how it was before the at-will laws came into play, it's how it still is in some states, it's how a large number of companies work today and it's how it is in a majority of other developed nations.


The problem here is you state clearly that a "clean bill" would be impossible yet you want to argue the issue like a clean bill was possible.

Sorry reality does not work that way, any attempts to change the law would have massive side effects because the "riders" as you call them would be added, the bill would not be a 10 page ensure employers go through a PIP, no it would be a 1000 page grab bag of special interest back room deals


even companies in at will states will often do a full pip process (can be more than a year) to exit a lower performer.

I've seen quite a few people exited by malicious managers who documented things in a PIP that didn't happen, and set rules for PIP exit that weren't attainable. All to avoid a lawsuit when a person is terminated.

Not sure that's highly functional.


And if you have been there for multiple years, with plenty of severance; at least one month per year of service IMO.


Typically employment isn't an absolute right. A company can always lay you off for no reason. They just have to compensate you X weeks/months pay (often linked to length of tenure) in order to do so if there is no cause. It does put an additional burden on companies, but the benefit to employees is huge (losing your job isn't an immediate crisis) and it doesn't seem to overly affect the availability of jobs.


at least not in The Netherlands, you cant lay off one person, laying off is very complicated process, and then after you lay them off you cant just hire new people on their place, etc.


Isn't this what unemployment supposed to solve?


In theory, yes. In practice, no, because the unemployment office can be slow and it can take weeks to receive your first payment. Before then, rent could be due and you still need to eat.

For most of us on HN, it's likely not a big problem. I personally have enough money stashed that I could go up to 6 months without a paycheck. But for someone making $9/hr that never has more than 2 paychecks' worth of money in their accounts, it's a disaster.


That depends on your jurisdiction. In countries where they pay a percentage of salary for a period time (e.g. 80% for 3 months) then that definitely works. Here in the UK, state provided unemployment payments are very low (think around minimum wage). That likely won't cover costs if you're used to a larger salary. Employer provided unemployment payments are meant to cover that transition period.


Most people rely on their job to survive. If a company can’t afford to absorb some risk when hiring, they have no place hiring people.


Because all the HR departments adopted the same policy, you don't really have a choice in the matter unfortunately.


At-will employment effectively negates any legal protections for termination, except in the rare circumstances where you can prove that you were illegally fired.


Doesn't that feel more like it should be described as "not explicitly illegal"? Saying that the reason must be legal gives it the sense that there is a list of valid reasons you could fire someone when, as I understand it, that list doesn't exist, and there's strictly a list of reasons you can't. "You wore green shoes so you're fired" is a reason that someone can be fired, but to say it's a legal reason gives it weight such a frivolous dismissal doesn't deserve.


Slight tangent, but boy do some companies take offense when an employee exercises that right, even as they hold the threat of termination over their employees.


I had such a time quitting my first job.

Me – I have decided to part ways with the company. Here's my 2 week notice. Let's work out a transition plan.

Manager – You can't do that! We have to ship this project by end of quarter. There's no way we will be able to find a replacement in time.

Me – Well that's unfortunate, but my end date isn't flexible.

Manager – Let me discuss this with [director] and get back to you.

Me – There is nothing to discuss. I'm not asking for permission.

And then he had the audacity to switch up the project dates and suggest that I work overtime and finish all the work before leaving.


Basically a state where you can fire someone for anything or nothing (besides being a protected class, retaliation for whitsleblowing and some other exceptions).


Thanks everyone for the responses, that twitter thread is making more sense now.


The employer can fire someone for any reason at all. Real or imaginary. Except for things protected by law like disability, etc.


For clarity, in this context "state" is referring to one of the U.S.'s 50 member states (e.g., Massachusetts, California, etc.)

In the U.S., the acceptable reasons for terminating an employee are somewhat governed by each state's laws. Although federal laws impose additional constraints which state laws cannot override.


The plot thickens...


how?


Zoom fired someone for a tweet discrediting a partner company.


Is it because of contractual obligations to not defame partner company? I have to assume its legal thats shutting this down as a concern of a litigation.


More likely just a friend calling in a favor, I would think. They didn't fire him on the spot, they asked him to delete the tweets first. That's what they really wanted.


Could be but the only leverage they have over him would be while he holds a job with them. As soon as he doesn't their obligations are over and are probably legally protected at that point. I imagine they wanted the tweets gone because they didn't want the legal risk.

It could also be a friend calling in a favor. Both very viable options.

Feel bad for the employee caught in the crosshairs.


Why watermark the docs with your name/handle? This is attention seeking and asking for trouble.

If the release is meant to be informative and altruistic - do it anonymously.


As expected appears that the poster has gotten relieved of his job, and has now created a post about his firing on HN


Lots of companies have reached out to him asking him to apply. I suspect he will get a better opportunity with better pay. :)


I'm perplexed by most of the response to this (the "brouhaha"). Don't we expect user desktop environments to become compromised from time to time? I mean, obviously we try to avoid that happening, but practically speaking it does happen because the user desktop is a very hostile environment and current protection measures are not really 100% effective. So instead we focus on defense in depth meaning that if a user's desktop is compromised, the amount of damage done is limited, by design.

I think the folks hollering that Okta knew a user desktop was compromised and "did nothing about the breach" are over playing that specific event. I'm going to guess that user desktops are compromised frequently and per se this doesn't represent a "breach". If it did, then every large company would suffer a breach every week, at least.

Surely the aspects to focus on are their apparent opsec failures such as passwords in XL spreadsheet, possibly lack of patches on the desktop OS, lack of rate limits on actions by support staff, lack of constraints to affect only users belonging to active support tickets, etc.


I don't think this is the source of the brouhaha, but wasn't this an RDP compromise ... not exactly "user desktop" compromise. Knowing how people do these things, my _guess_ is that Sitel has a fairly locked down desktop. But not locked down enough -- somehow RDP is allowed. The user here doesn't care to work in the Sitel desktop as probably things are highly restricted, so does RDP in from his personal machine.

> I'm going to guess that user desktops are compromised frequently

doubtful

But as I said, I don't think this is what has people up in arms.


Again and again this seems to be true:

No matter what they say or do or what you perceive from brash to goodie-two-shoes, the real truth only comes out when real shit hits the fan.


It’s like the stoics said: You can’t judge the skill of a captain on calm, flat waters. It’s in a storm or emergency that threatens to sink or ground the ship that you see what they’re really made of.


Discussion with a coworker sparked a perspective I hadn't considered. Did he obtain these documents because of disclosures made to Zoom and him having access because he's an employee (& potentially being covered by NDAs he signed)? Or did he obtain them in some other fashion? That would change the perspective of him being fired over these tweets.


He says he got them independently of his employment at Zoom.


Link? I missed that in the thread



Looks like Okta doesn't take security seriously.


What the heck is hxxps?


in the past i've found that replacing all instances of 'http' with 'hxxp' in data from untrusted or dangerous sources will reduce the chances of accidentally accessing URIs that you would not want anyone to be able to go to accidentally. it's an extra hoop to jump through, like spelling out an email address to stymie spam harvestors.


also avoids the source of the link being shown as a referral on analytics dashboards


There are analytics dashboards for pdf documents?




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: