Category Archives: SSO

What’s the point of users having to authorize their SSH keys and tokens they created themselves when SAML single sign-on is enabled on GitHub?

Posted on by

In GitHub’s Enterprise Cloud docs it says:

To use an SSH key with an organization that uses SAML single sign-on (SSO), you must first authorize the key.

I understand that organization admins could have the power to invalidate individual … Continue reading What’s the point of users having to authorize their SSH keys and tokens they created themselves when SAML single sign-on is enabled on GitHub?→

MITM Attacks Can Still Bypass FIDO2 Security, Researchers Warn

Posted on by

By Deeba Ahmed
Is FIDO2 truly unbreachable?  Recent research exposes a potential vulnerability where attackers could use MITM techniques to bypass FIDO2 security keys.
This is a post from HackRead.com Read the original post: MITM Attacks Can Still Byp… Continue reading MITM Attacks Can Still Bypass FIDO2 Security, Researchers Warn→

Analyzing impact of leaked client_secret in Authorization Code Flow in Keycloak (CVE-2020-27838)

Posted on by

CVE-2020-27838 describes that Keycloak has an open endpoint where it’s possible to obtain client_secret information, as shown in the example below:
/auth/realms/{realm}/clients-registrations/default/{client_id}

Through other discussions, … Continue reading Analyzing impact of leaked client_secret in Authorization Code Flow in Keycloak (CVE-2020-27838)→

Product showcase: How to track SaaS security best practices with Nudge Security

Posted on by

As technology adoption has shifted to be employee-led, IT and security teams are contending with an ever-expanding SaaS attack surface. At the same time, they are often spread thin, meaning they need ways to quickly identify and prioritize the highest-… Continue reading Product showcase: How to track SaaS security best practices with Nudge Security→

Phishers target FCC, crypto holders via fake Okta SSO pages

Posted on by

A new phishing campaign is using fake Okta single sign-on (SSO) pages for the Federal Communications Commission (FCC) and for various cryptocurrency platforms to target users and employees, Lookout researchers have discovered. The phishing campaign By … Continue reading Phishers target FCC, crypto holders via fake Okta SSO pages→

Understanding zero-trust design philosophy and principles

Posted on by

In this Help Net Security interview, Phil Vachon, Head of Infrastructure in the Office of the CTO at Bloomberg, discusses the varying definitions of zero trust among security professionals and companies, emphasizing its broad design philosophy. Vachon … Continue reading Understanding zero-trust design philosophy and principles→