←back to thread

Microsoft said it lost weeks of security logs for its customers' cloud products

(techcrunch.com)
285 points alephnerd | 2 comments | 20 Oct 24 21:42 UTC | HN request time: 0s | source
Show context
neya ◴[21 Oct 24 07:28 UTC] No.41901576[source]▶
If you use Azure in any realistic production environments, then it's on you. Even with $100k in free credits, they couldn't convince me to use it for more than a month. It is expensive, the interface is highly user unfriendly and most important of all, their products don't at all seem reliable for production workloads because of stuff like this. Sorry Microsoft, I think you can do much better.
replies(15): >>41901755 #>>41902286 #>>41902571 #>>41902679 #>>41902715 #>>41903167 #>>41903320 #>>41903580 #>>41903869 #>>41904371 #>>41904976 #>>41905535 #>>41905826 #>>41905858 #>>41907485 #
prennert ◴[21 Oct 24 10:43 UTC] No.41902715[source]▶
When you come from other cloud providers, working with Azure has so many dark-orange flags. It feels totally inconsistent and patched together. This makes it hard for me to believe that anybody can properly audit it for security.

The most uncomfortable part is their log in. The amount of re-directs and glitches there are insane. Its hard to believe that it works as intended.

As an example, for some reason I could not download the BAA because trying to download it lead to a login loop on their trust website, while I was still able to see the Azure console ok in the same browser.

When I signed out of my Azure account to try if a fresh login helped, it did not trigger my 2FA at the next login. In my mind, if I actively logged out from a browser window, I withdraw my trust in that device. So not being triggered for 2FA is a massive red flag.

(no I still could not download the BAA, nor file a ticket for it, but somehow a colleague could download it ok.)

replies(7): >>41902823 #>>41903429 #>>41904108 #>>41904633 #>>41904940 #>>41905080 #>>41909148 #
chrisandchris ◴[21 Oct 24 13:45 UTC] No.41904108[source]▶
> [...] is their log in.

On every first try, I cannot log in into Azure Portal. I chlick "try again", it works. And it's like that for months, if not years.

IMHO it says a lot of your culture if every first interaction of your customers with your product end with an error - and you simply don't care to fix it.

replies(3): >>41904452 #>>41904654 #>>41907751 #
velcrovan ◴[21 Oct 24 14:38 UTC] No.41904654[source]▶
No offense, but consider that there's a chance it's a problem on your end. I have never had this issue, and no one I know has had this issue.
replies(4): >>41904917 #>>41905200 #>>41905375 #>>41905460 #
1. lukeschlather ◴[21 Oct 24 15:54 UTC] No.41905460{3}[source]▶
I would guess it is a problem with OP's account. Which is to say it is thoroughly a Microsoft problem, and probably one that could be fixed but would require weeks of back-and-forth until someone with direct access to some number of auth databases corrected the issue.

I will say, they made a change to the auth system recently that made log-in significantly worse. Now several times a day my session expires or something and I go through a 5-10 second redirect flow which visibly jumps between different login APIs to refresh my log in state. (And of course this happens at the start of the day.)

replies(1): >>41907417 #
2. velcrovan ◴[21 Oct 24 19:16 UTC] No.41907417[source]▶
It's also possible your tenant admin updated Conditional Access rules for some locations or applications. Or maybe they screwed up the Hybrid AAD sync from the on-premise DC. As I've been trying to point out elsewhere, tenant admins have a much higher influence on these outcomes than people are willing to admit, and there are a lot of admins out there who can't be arsed to keep up. I've made some of those mistakes myself.