# User Security **URL:** \ **Category:** office app\ **Tags:** operation-node\ **Created:** [August 28, 2021, 8:32am UTC](https://discuss.88.io/t/user-security/264 "2021-08-28T08:32:53Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![admin](https://discuss.88.io/user_avatar/discuss.88.io/admin/32/38_2.png) [@admin](https://discuss.88.io/u/admin)\ **Post date:** [August 28, 2021, 8:32am UTC](https://discuss.88.io/t/user-security/264/1 "2021-08-28T08:32:53Z")
# User Security is No Security ---
**Author:** ![admin](https://discuss.88.io/user_avatar/discuss.88.io/admin/32/38_2.png) [@admin](https://discuss.88.io/u/admin)\ **Post date:** [August 28, 2021, 9:21am UTC](https://discuss.88.io/t/user-security/264/2 "2021-08-28T09:21:22Z")
# Identity Provider Fallacy Cloud Compute are mostly secured by identity providers (IdP) - Dishonest Administrator An administrator within the IdP can directly access and misuse user credentials, such as re-using username and password combinations to impersonate users to third-party services. - Powerful Management Even if all the administrators honest, they can still be ORDERED to impersonate you by management or government. - Credential Theft If an attacker obtains the administrative credentials for an IdP, they can modify it to extend trust to domains or users they control, which then allows them to impersonate many users. - Federation Weakness This involve IdP talking to each other, with hackers compromising the IdP [federation process](https://www.crowdstrike.com/en-us/blog/compromising-identity-provider-federation/). - Cross-IdP Impersonation An attacker can create a fraudulent IdP with a domain that matches your company's domain. When you try to log in to a service using SSO, you might be tricked into authenticating through the attacker's IdP, granting them access to your accounts on downstream applications. - Key Compromise Numerous techniques (e.g [golden saml](https://netwrix.com/en/cybersecurity-glossary/cyber-security-attacks/golden-saml-attack//), [golden ticket](https://netwrix.com/en/cybersecurity-glossary/cyber-security-attacks/golden-ticket-attack/) etc.) can compromise signing keys or forge authentication tokens to bypass IdP security measures. Reference: - [XPN InfoSec Blog](https://blog.xpnsec.com/identity-providers-redteamers/) ---
**Author:** ![admin](https://discuss.88.io/user_avatar/discuss.88.io/admin/32/38_2.png) [@admin](https://discuss.88.io/u/admin)\ **Post date:** [August 28, 2021, 9:21am UTC](https://discuss.88.io/t/user-security/264/3 "2021-08-28T09:21:46Z")
# VPN Fallacy Virtual Private Network (VPN) was design with CENTRALISED control and security for use in a corporate environment where the boss can see and controls all communications. Running VPN as a public service is NOT LONGER providing "private" network by definition and the real problem is that even if it is "private", the word "private" in VPN means that the communication is private to the company - not to the individual users (employees). **Trusting your VPN provider more than your government regulated carrier is like trusting your cryptocurrency exchange more than your government regulated bank.** The more traffic you put through a VPN, the more valuable it is as a target and the more you will be exposing yourself to their staff or to the people who hacked them. ## NordVPN Breached > **[NordVPN Breached - Schneier on Security](https://www.schneier.com/blog/archives/2019/10/nordvpn_breache.html)** > > There was a successful attack against NordVPN: Based on the command log, another of the leaked secret keys appeared to secure a private certificate authority that NordVPN used to issue digital certificates. Those certificates might be issued for... ## LimeVPN Breached > **[Hacked Data for 69K LimeVPN Users Up for Sale on Dark Web](https://threatpost.com/hacked-data-limevpn-dark-web/167492/)** > > LimeVPN has confirmed a data incident, and meanwhile its website has been knocked offline.