Rendered at 00:53:17 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
paxys 40 minutes ago [-]
Trusting Lenovo as an auth provider is certainly a decision..
Handling SSO related security-holes in SaaS apps has made up a major chunk of my career at this point.
The most common one – app adds SAML-based login and treats the returned email from the SSO provider as authoritative. What the developers don’t realize is that you can set up your own tenant with most major SSO providers and assign users any arbitrary email – no verification needed.
And if an account with the same email address already exists in your system – congrats, you have just granted full access to it to basically anyone.
curuinor 4 hours ago [-]
Any serious career programmer knows in their bones that it's a miracle that anything works at all. Now the general public is getting to learn that fact, by everything systematically breaking. Or getting hacked, in this case.
hoppp 4 hours ago [-]
Its just gonna get worse over time.
4 hours ago [-]
45 minutes ago [-]
k310 4 hours ago [-]
It seems that hacks are only a matter of "when" and not "if"
I have two credit cards (paid up monthly) for just such a reason and may get a third.
gonzalohm 2 hours ago [-]
You mean as a way of protecting against fraudulent charges? If so, there are services that give you single use card numbers and you can set up spending limits.
k310 1 hours ago [-]
Just so if one gets hacked, I have a working on in the interim, as new one is issued.
Handling SSO related security-holes in SaaS apps has made up a major chunk of my career at this point.
The most common one – app adds SAML-based login and treats the returned email from the SSO provider as authoritative. What the developers don’t realize is that you can set up your own tenant with most major SSO providers and assign users any arbitrary email – no verification needed.
And if an account with the same email address already exists in your system – congrats, you have just granted full access to it to basically anyone.
I have two credit cards (paid up monthly) for just such a reason and may get a third.