HackerTrans
TopNewTrendsCommentsPastAskShowJobs

kl343

no profile record

Submissions

"All Your Secrets Are Belong to Us" – A Delinea Secret Server AuthN/AuthZ Bypass

straightblast.medium.com
2 points·by kl343·hace 2 años·0 comments

Even the LastPass will be stolen, deal with it (2015) [pdf]

blackhat.com
43 points·by kl343·hace 4 años·21 comments

comments

kl343
·hace 3 años·discuss
Firmly agree with other posters that Microsoft's identity services leave a lot to be desired... but Jeff is being a bit sensationalist here.

The school did not "take over" his MS account. At some point (likely amidst a mountain of other onboarding tasks for his daughter's enrollment) he would have received an invitation to join the school's Azure AD tenant as a guest/external user. In this case, he chose to join using his Microsoft account, rather than create a new email-based guest account.

"Leaving" the school's org only breaks one side of the federation, and the guest account and it's association to the school's Azure tenant still remains.

To resolve, he'll need contact the school and have them delete the account. Meanwhile, it probably would have been better to create the app beneath an Azure AD tenant belonging to the non-profit org in the first place.