Okta Exposes Passwords in Clear Text for Possible Theft
> For Okta's part, the passwords are in clear text because there is no standard reliable protocol for syncing hashes, researchers noted. However, Authomize noted that Okta did pledge to have its product team take a closer look at the password-leak risks.What???Can someone fill me in as to why they can’t just store the password using something like bcrypt?I guess you either have to store the password in plaintext so they can do dynamic hashing operations on it, or transmit the password (via TLS hopefully) which is vulnerable to packet capture (or captured within the receiving app).Are there any techniques for identity providers to authenticate people without storing or transmitting the users password to them?