Okta Exposes Passwords in Clear Text for Possible Theft
There seems to be a lot of confusion here. First of all, for the users that have passwords, Okta stores those passwords as hashes.<p>The claim that Okta exposes plain text passwords is only true in an edge case: When an Okta administrator has set up password syncing to a downstream system.<p>For this to work, the person who sets this up has to be an administrator and they have to SPECIFICALLY enable password syncing (the default is to sync random passwords). Even then, the real user passwords can only be synced at the time of login. Because, as stated above, Okta stores passwords as hashes.<p>(Full disclosure, I have been an Okta employee for over 8 years)