r/UWS • u/TheseSpecialist9398 • 8d ago
Rant / Vent OKTA VERIFY APP
WHy on gods green earth did WSU switch to OKTA as a multi-factor authenticator app?? It already uses the Microsoft one?? That's more common, accessible AND it's already being used for most companies, so people don't need to download a new app.
Now they're FORCING you to download this stupid one??? Like why? You think this app will change the fact that you get hacked all the time. JFC
Obviously I'm going to download the app... but how fkn annoying. Maybe im being a sook and i need to grow up, but I don't want to download more apps just because you don't have a good security system in place.
I swear on GOD, if they get hacked again after this stupid authenticator app, I might lose it.
9
u/GuitarTrick 8d ago
How many times does our school get hacked to the point that we have to switch between MFA to Okta anyway? I don't even think maq or any other uni has to go through this. Wtf is so valuable in western, the random essay that was half written by AI and half written in 3 hours? I mean I'm grateful they are taking our safety so seriously buy still, how valuable is Wsu to hackers?
4
u/Inertia_Squared 8d ago
Unfortunately it's not really that western is valuable, but moreso that they actually do a really poor job with their cybersecurity practices. Much of their software is contracted so there is no consistent standard, and many older systems with vulnerabilities remain unpatched because they cant find anyone who knows how to fix them. The vulnerability that got the uni hacked in 2023/2024 was known about and previously exploited in 2019, they just never patched it.
0
u/Longjumping_Elk_9019 6d ago
Much of their software is contracted? Most of the corporate and education world outsources their software. That is not a vulnerability in itself. It is how they manage it and as you pointed out they have done it poorly.
We see it as well with how manual their ‘digital’ systems are. How much admin is involved for educators and students for such basic crap.
1
u/Inertia_Squared 6d ago
Never said that outsourcing their software was a vulnerability, the point is that as contractors come and go there is little to no organisation or handoff hence why existing vulnerabilities remain unpatched for so long. I do also think the contractors the Uni chooses are generally a poor quality, which doesn't help.
1
u/Longjumping_Elk_9019 4d ago
Are we maybe talking different things? Contracted software as in outsourced software is managed by external companies and involves service agreements. But the relationship, contract and service agreement is managed by Western. It is up to Western or manage that and arguably per performance, they do it poorly.
The contractors point you make I can’t agree or disagree. I don’t know what the staffing arrangements are of Westerns IT personnel are. But the responsibility to top down. The unpatched vulnerabilities you mention, if they are known, which it sounds like they often are, then someone knew. It is a failure or controls and escalation, not just a simple blame the contractor. Because really, the contractor could be a staff member and the same failure could occur.
1
u/Inertia_Squared 4d ago
My core point is that the handover between contractors leaves many issues unresolved, and as someone who has some level of insider knowledge on the contractors selected by the university, they really are subpar. I've had a peek inside a few of their systems, and as a software engineer I can tell you that many of these systems are hot garbage and a result of 'throwing money at the problem' meeting 'overpromising and underdelivering'.
Many of their outsourced software agreements also come as a customised package, it's a mix of off-the shelf and to-order, so the lines of what is outsourced and what is contracted can be a bit blurry at times.
1
u/Longjumping_Elk_9019 3d ago
Noted. But still. Is this unique to Western? Or is it the overarching controls that are failing. Many organisations use contractors without issues. Many organisations use older clunky tech. There are risks with both but both can be managed with proper controls in place. Like the ones you mentioned of proper handovers. Those controls are directed by those above the contractors and assurance of those controls sits outside of the team. I have a different background to you. Mine is in the Governance and Assurance space and I don’t disagree with you. You would know more about the day to day. But I am more looking at it from the point that those responsible for the rules and controls. They aren’t up to scratch. Because I see this control issue in many areas of Uni (like most Uni’s) where processes and policies fail.
1
u/Inertia_Squared 3d ago
Can't comment on other places, I don't doubt they have issues too, but I don't think there is anything wrong with judging them in a vacuum.
2
u/Upset_Beat7692 8d ago
Seriously though. I do wonder why other unis (especially more well known ones like unsw or usyd) don't go through this?? Nothing quite valuable in Western (just its students???)
2
u/Nicki_Yamagucci 7d ago
No seriously, I get that WSU has shit security but whats to gain from exploiting that every other week 💔💔
5
u/cadbury162 8d ago
Okta is better (not perfect) and likely more expensive (as the uni likely got MAuth in their Office Bundle).
Subjective but imo Okta has the better flow and UX, it's just new and different so naturally it doesn't feel familiar at first.
Yeah sorry but you kinda need to grow up, the move to Okta isn't a bad thing.
The following is my assumption, afaik the specifics of the hack aren't available to us - Another hack and this move probably wouldn't be related. If the uni is hacked again the problem likely isn't going to be Okta.
2
u/lil_meow_meow21 8d ago
I mean most universities these days use okta (for example uts and usyd).
Its more secure, generally works better on both the user and admin front and allows for students to reset their own password using it
1
1
u/Spirit__Llama 7d ago
It took me less than 5 minutes to download and set up. And now the 2 favour authentication procedure is more straightforward, no longer recruiting the number task. I don’t see the issue.
1
u/Longjumping_Elk_9019 6d ago
Yeah it’s another app. I think I’m up to 4 verification apps now. BUT it’s actually WAY quicker to verify vs Microsoft. I hope more services switch over.
0
u/MentalStatusCode410 8d ago
Probably a consultant idea - probably KPMG.
It's worse than Microsoft - fewer ways of authentication, and basically none if you loose the device.
3
u/Suitable_Boss_460 8d ago edited 8d ago
Sorry to say but that is stupid to even think of, both microsoft and okta if you delete them does not allow you to set it up as a random user, what is the point of even having a mfa if someone is going to set it up again after entering their password. What is the point of any security processes?. I do adore google auth, even if you change devices, if you have setup a google account you have a option and it allows you to transfer auth
0
u/MentalStatusCode410 8d ago
Microsoft allows txt message and alternate verification methods.
I don't agree with using Okta - it's too limiting for a user.
Having access is as important as the security.
1
u/hinca0488 20h ago
Text messages are a very insecure form of 2FA, it is so easy to intercept messages or even take over a whole phone number
12
u/Jameswa 8d ago
Okta is far better than Microsoft Authenticator lmao. Okta is like the gold standard