OneLogin Provides One Easy Way to Let Someone Access Your Credentials

It is indeed convenient to have all account passwords and login names in one place. Just login in one time, with one set of credentials and off you go to whichever application you desire and no need to remember a bunch of different combinations. However, putting all your eggs into one basket comes with considerable risk. Just ask customers of the single sign-on (SSO) company OneLogin how it feels to be notified that not only might your data have been accessed, but encrypted data may also have been decrypted when an intruder got ahold of it.

The company has publicly announced that it indeed found an unauthorized party inside its network who did this. Not many details have been provided, but they did send a notification to those affected with a rather long list of tasks to protect their accounts. These included generating new certificates for applications that use SAML SSO, generating new directory tokens, recycling any secrets that are stored in the Secure Notes feature, and of course updating passwords.

Having all of this information for accounts in one place is very risky. Now, not only does the intruder have one password to one account, but he or she also has many or all credentials to many or all accounts. This is the price to pay for convenience.

It isn’t advised by most security professionals to do this, exactly for this reason. OneLogin isn’t the only product like it to experience a security breach. In 2015, the password management product, LastPass was also compromised and master passwords were accessed. Again in 2016, a researcher found a way to take advantage of flaws in how LastPass worked to bypass its security measures.

OneLogin has some limited information on its support page, which is accessible only to customers (of which it claims to have around 2,000). However, it is rather vague according to reports. The CISO has also written in a blog post that the unauthorized party has been blocked, law enforcement has been notified, and a security firm was hired to help get to the bottom of this.