1Password detects "suspicious activity" in its internal Okta account

• pass-import

  403 768 8.4 Python

  A pass extension for importing data from most existing password managers

• prevent-exfiltration

  1 0 10.0 JavaScript

5. Server validates signature and timestamp

The security issue is in step 1. WebCrypto can generate non-extractable private keys and store them in indexeddb. However, this assumes no malicious code flips the “extractable” flag before the pair is generated. So this strategy is trust-on-first-use.

[0] - https://chromestatus.com/feature/5097603234529280

[1] - https://github.com/kevlened/prevent-exfiltration/blob/main/i...

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

Suggest a related project