This is a hard no for me. Not even entirely that they were hacked multiple times...

hn_throwaway_99 · 2023-08-30T00:42:56

I don't understand your position:

1. In the first hack, if anything Okta over communicated about the hack: the hack ended up being much less severe than they originally said was possible, and, from a security perspective, the hack didn't really have any negative consequences to customers.

2. Your second 2 links are about the same issue, which was a breach of their GitHub accounts. Again, it's worrisome that someone could find vulnerabilities in their source code, but no customer data was compromised.

You're free to think what you want about the severity of these hacks (I personally think they're low), but I don't see how you could have problems with "how they dealt with it each time". They seemed to have textbook correct incident response communications - what else would you suggest they had done?

Also, given the nature of the breaches, I don't think they point to severe security culture problems at the company (in contrast, for example, to the LastPass and Solarwinds breaches, which showed all the signs of clown show security culture IMO).

toomuchtodo · 2023-08-30T00:20:27

Identity providers are competing with passkeys now in non business/org settings, and there is only so much idp/SSO enterprise marketshare to fight over. Similar story with password managers (yes, yes, there will always be a market for folks who want to backup their passkeys to sovereign storage with a passkey manager, and that capability should exist, but your average user won’t; they’ll rely on iCloud/Google/Chrome storage, governance, and access controls for key material).

(IAM is a component of my work)

anotherhue · 2023-08-30T00:36:40

Absolutely this, plus the fact that this smells like a pet project that'll get shut down next time there's a reshuffle. Keep it.