My employer just started using Okta and I find it hard to take anything they say about security seriously after seeing some of the obvious bullshit in the immediate user-facing aspects of their product:
- allowing security questions to reset passwords
- allowing sms resets of passwords
- allowing sms 2-factor in combination with sms resets
I understand that my company is largely at fault for enabling these, but it's scary that they're even options. It's also pretty stupid that their password requirements are 8 characters, mixed case, and at least 1 number.
- allowing security questions to reset passwords
- allowing sms resets of passwords
- allowing sms 2-factor in combination with sms resets
I understand that my company is largely at fault for enabling these, but it's scary that they're even options. It's also pretty stupid that their password requirements are 8 characters, mixed case, and at least 1 number.