←back to thread

Microsoft said it lost weeks of security logs for its customers' cloud products

(techcrunch.com)
285 points alephnerd | 2 comments | 20 Oct 24 21:42 UTC | HN request time: 0s | source
Show context
neya ◴[21 Oct 24 07:28 UTC] No.41901576[source]▶
If you use Azure in any realistic production environments, then it's on you. Even with $100k in free credits, they couldn't convince me to use it for more than a month. It is expensive, the interface is highly user unfriendly and most important of all, their products don't at all seem reliable for production workloads because of stuff like this. Sorry Microsoft, I think you can do much better.
replies(15): >>41901755 #>>41902286 #>>41902571 #>>41902679 #>>41902715 #>>41903167 #>>41903320 #>>41903580 #>>41903869 #>>41904371 #>>41904976 #>>41905535 #>>41905826 #>>41905858 #>>41907485 #
prennert ◴[21 Oct 24 10:43 UTC] No.41902715[source]▶
When you come from other cloud providers, working with Azure has so many dark-orange flags. It feels totally inconsistent and patched together. This makes it hard for me to believe that anybody can properly audit it for security.

The most uncomfortable part is their log in. The amount of re-directs and glitches there are insane. Its hard to believe that it works as intended.

As an example, for some reason I could not download the BAA because trying to download it lead to a login loop on their trust website, while I was still able to see the Azure console ok in the same browser.

When I signed out of my Azure account to try if a fresh login helped, it did not trigger my 2FA at the next login. In my mind, if I actively logged out from a browser window, I withdraw my trust in that device. So not being triggered for 2FA is a massive red flag.

(no I still could not download the BAA, nor file a ticket for it, but somehow a colleague could download it ok.)

replies(7): >>41902823 #>>41903429 #>>41904108 #>>41904633 #>>41904940 #>>41905080 #>>41909148 #
chrisandchris ◴[21 Oct 24 13:45 UTC] No.41904108[source]▶
> [...] is their log in.

On every first try, I cannot log in into Azure Portal. I chlick "try again", it works. And it's like that for months, if not years.

IMHO it says a lot of your culture if every first interaction of your customers with your product end with an error - and you simply don't care to fix it.

replies(3): >>41904452 #>>41904654 #>>41907751 #
velcrovan ◴[21 Oct 24 14:38 UTC] No.41904654[source]▶
No offense, but consider that there's a chance it's a problem on your end. I have never had this issue, and no one I know has had this issue.
replies(4): >>41904917 #>>41905200 #>>41905375 #>>41905460 #
1. deathanatos ◴[21 Oct 24 14:59 UTC] No.41904917{3}[source]▶
Every login I've ever done into the Azure portal is like the upstream describes: an absurd number of redirections and refreshes that leave you wondering "is it supposed to work like that?"

I've also encountered strange bugs, like asking to log into tenant A and getting logged into, instead, tenant B. In a loop, effectively locking me out.

The exact quirks and bugs seem to come and go, I presume as the code is changed & updated.

replies(1): >>41907367 #
2. velcrovan ◴[21 Oct 24 19:12 UTC] No.41907367[source]▶
Sure, but Azure also exposes an extremely large array of knobs and buttons that put the tenant admin squarely in control of what "login" means in the first place: the kinds of authentication allowed or required, by whom, under what risk profiles, for which applications, etc. If you feel like it is screwed up there is, as likely as not, action that it is the tenant admin's — not MS's — responsibility to take, to fix it. I don't know what to tell you about refreshes, that's just how Oauth works mostly. I'm tempted to take a video of myself logging into the Azure portal right now just to ask what about it is so weird.