Connect with us

Technology

An Okta login bug bypassed checking passwords on some long usernames

Published

on

An Okta login bug bypassed checking passwords on some long usernames
Illustration by Cath Virginia / The Verge | Photo from Getty Images

On Friday evening, Okta posted an odd update to its list of security advisories. The latest entry reveals that under specific circumstances, someone could’ve logged in by entering anything for a password, but only if the account’s username had over 52 characters.

According to the note people reported receiving, other requirements to exploit the vulnerability included Okta checking the cache from a previous successful login, and that an organization’s authentication policy didn’t add extra conditions like requiring multi-factor authentication (MFA).

Here are the details that are currently available:

On October 30, 2024, a vulnerability was internally identified in generating the cache key for AD/LDAP DelAuth. The Bcrypt algorithm was…

Continue reading…

Advertisement
Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Technology

Hyundai’s cutesy Inster EV doesn’t need to be quick

Published

on

Hyundai’s cutesy Inster EV doesn’t need to be quick

The reviews for Hyundai’s little electric SUV that could are trickling in, and it’s clear that the Inster is a delightful way to move about town — regardless of its lack of quickness compared to other similarly-sized EVs. The Inster’s top speed for the long-range version is about 93 miles per hour (or 150 km/h), and it has a zero to 62 mph (100km/h) acceleration in 10.6 seconds, according to the specs Hyundai published today.

Hyundai also revealed more details about the Inster’s price, with European reviewers saying it’s expensive compared to similar competition at £23,495 (about $25,477). In the US, however, that’s a price we can only dream about since our most affordable options include the $35,000 Chevy Equinox EV or the hope Tesla will deliver a cheaper car for around $25,000.

Hyundai uses the Casper name in Korea only.
Image: Hyundai

One newer compact EV that has made it to the US is the Fiat 500e. At 143 inches in length, it’s only about 7 inches shorter than the Inster at 150.59 inches. However, the Inster has more internal storage since it’s SUV-shaped, plus it has a range of about 230 miles WTLP on the long range 49 kWh battery compared to the 500e’s, which is under 200 miles.

Continue Reading

Technology

Your SSN is on the dark web — here’s what to do about it

Published

on

Your SSN is on the dark web — here’s what to do about it

Your Social Security number is one of the most sensitive pieces of personal information you own. Too bad yours (and mine and every other Americans’) has likely been leaked and sold on the Dark Web.

Before you panic, there are a few steps you can take right now to protect yourself and your identity.

TURN YOURSELF INTO A GOOGLE WORKSPACE AND MICROSOFT OFFICE PRO

I’m giving away an iPhone 16 Pro with Apple Intelligence. No purchase necessary; enter now!

Is it really that big a deal?

Advertisement

It sure is. Your Social Security number is the key to the castle. It’s the unique identifier that connects your financial, government and personal records.

With your SSN, criminals can open credit card accounts, apply for loans, hijack your tax refunds, use your government benefits or even apply for jobs.

There’s an easy step you can take.

In this photo illustration, a Social Security card sits alongside checks from the U.S. Treasury on October 14, 2021, in Washington, DC.  (Kevin Dietsch/Getty Images)

To safeguard your Social Security number, use the government’s free Self Lock feature. This tool prevents your SSN from being used for unauthorized employment verifications. You’ll need an E-Verify account to do this online.

Advertisement

You can also request a block by calling the Social Security Administration at 1-800-772-1213. Expect to wait on hold for a long time.

Stay proactive

The Social Security Administration also provides online access to your earnings and benefits history through its my Social Security account. It’s free to use and you can get an account even if you don’t receive benefits.

I recommend you check this once a year to make sure nothing is amiss. Check the reported income and confirm everything aligns with your actual work and benefits history.

WATCH OUT: BIGGEST DATA BREACHES OF 2024, SO FAR

Advertisement

Note that if you created a Social Security username more than 3 years ago, you’ll need to create a Login.gov account or use an ID.me account.

The reg flags

How do you know if your SSN is in someone else’s hands? Let me count the ways …

Unexpected bills or accounts: Receiving bills or statements for accounts you never opened is one of the most obvious signs someone is using your Social Security number. Thieves can use your SSN to open credit card accounts, take out loans or even set up utilities in your name. 

If this happens, contact the company immediately and report the fraudulent activity. At this point, a credit freeze is a must, too.

Advertisement
A laptop

A woman uses a laptop on April 3, 2019. (ISSOUF SANOGO/AFP via Getty Images)

Tax forms that aren’t yours: If you get tax forms like W-2s or 1099s in the mail from employers you’ve never worked with, it could mean someone used your SSN to get a job. In this type of employment fraud, someone who may not otherwise pass employment checks uses your identity instead. It’s a mess and could leave you on the hook for their tax obligations.

Contact the IRS right away if you get any strange tax forms. 

Tax filing goes awry: You file your taxes, then get a notice that someone else already filed using your SSN. This is a simple and surprisingly effective way for criminals to get refunds owed to you.

Act fast if you get a letter from the IRS about a duplicate filing. Go to IdentityTheft.gov to file a report. You may need to complete IRS Form 14039, the Identity Theft Affidavit, to officially report the incident.

Pro tip: Protect your tax accounts before this ever happens. The IRS offers a special Identity Protection PIN program. You get a six-digit number to use for filing your taxes, effectively locking your account to outsiders.

Advertisement

TIME-SAVING TRICKS USING YOUR KEYBOARD

Hints on your credit report: I bet you see a theme here. Anything you know wasn’t you is the biggest sign. That can include new accounts, lines of credit you didn’t take out or other unexplained changes to your credit. 

You can get a free credit report once a year from each of the three major credit bureaus through AnnualCreditReport.com. Pro tip: Stagger the reports every few months to keep an eye on it more easily across the year. 

Government benefit denials: If you’re denied benefits like disability, Medicare, unemployment or other government assistance, someone may already be using your SSN to claim them fraudulently. 

If it happens to you, reach out to the agency and explain the situation. They will guide you to the next steps to restoring your benefits.

Advertisement
hacker

A person dressed as an internet hacker is seen with binary code displayed on a laptop screen in this illustration photo. (Photo by Jakub Porzycki/NurPhoto via Getty Images)

Suspect your SSN was stolen?

Move quickly. Start with the Federal Trade Commission at IdentityTheft.gov. Fill out the form there, and you’ll get an entire plan for how to recover your identity and protect yourself going forward.

The IRS also has a place to report if you suspect someone is using your SSN: Identity Theft Central.

Check with your bank, credit card providers and insurance company, too. Some offer free fraud and identity theft protection services that can help you keep everything locked down.

Advertisement

Get tech-smarter on your schedule

Award-winning host Kim Komando is your secret weapon for navigating tech.

Copyright 2025, WestStar Multimedia Entertainment. All rights reserved.

Continue Reading

Technology

WhatsApp’s new custom lists help organize your chats

Published

on

WhatsApp’s new custom lists help organize your chats

WhatsApp is adding yet another way to organize all your chats. If you’re tired of struggling to find certain conversations, now you can slot them into custom categories, called Lists.

You can create and label lists dedicated to specific chats, such as those with your family or work colleagues. The messaging app will then display them at the very top of your inbox, alongside the “All,” “Unread,” and “Groups” filters WhatsApp rolled out earlier this year.

To create a list, tap the “+” icon in the filter bar at the top of your chats tab. You can then enter a name for your list and choose which conversations to add. WhatsApp will let you add both group chats and one-on-one conversations to your lists. If you have multiple lists, you can scroll horizontally on the filter bar to view all of them.

Lists start rolling out today, and I’m already seeing the feature on the Android version of the app. If you don’t see it yet, don’t worry, as WhatsApp says it will become available to everyone in the “coming weeks.”

Continue Reading

Trending