Don’t use Okta. Wait, you want to know more? How about the utter mishandling of user information and complete disregard for transparency?

Even funnier, it was revealed that the September/October breach was actually much more serious than was originally believed and leaked everyone’s information. All while I was editing this video.

How to Protect Yourself from Okta:

Okta requires a phone number, the email your IT admin associated with your account, or in certain configurations, downloading the app as the only option. So you don’t want to give them a phone number or download the app because of their awful practices and your value for privacy, what can you do?

  • Using a work VOIP number: If your employer provides a voice over IP (VOIP) phone number, you can use that as a second factor. This is my current strategy.
  • Using a “burner” phone number: If you own more than one phone number, you can dedicate another phone number to protect your personal phone number.
  • Using a separate Android profile: If you use Android, you can create a separate profile for your work apps and download the Okta app. It’s not totally anonymous, but using the QR code for their 6 digits, it doesn’t require internet access.
  • Using Android-x86 in a virtual machine or spare device: You can sideload the Okta Verify app and sign in to your email in the virtual machine to receive a magic link. When the app is installed, you can click the link and bind the virtual machine’s app to Okta’s push notification system.
  • The old phone: If you have a spare old smart phone, you can download the app there.
  • Using a third party emulator: There are many commercial Android emulators, like GenyMotion or Bluestacks.

Side notes:

  • The Okta app works without Google Play Services, but you will not receive notifications.
  • Okta’s push verification requires internet access, but their proprietary 6 digit codes works without internet access. It is not Google’s standard, so you can’t use a conventional TOTP app.
  • I tried Waydroid, but the orientation and functionality of the Okta app within it is questionable at best.
  • It would be worth looking into Google’s Android Studio and trying to run it there.

Alternatives to Okta

Referenced