The security vendor's blog, covering vulnerability research, identity and privileged access, and incident disclosures such as the Okta support breach.
HN links it mainly for its Okta support unit breach report, which commenters note showed the firm detected and escalated the breach before Okta acknowledged it.
> Is it better to use a different passphrase on each key, or does using the same one not matter much?
Using a passphrase is highly recommended except for server-to-server accounts, which should be locked down (and specify the specific command that server can execute in the authorized_keys file - Userify[1] supports this).
You should definitely use a different passphrase for keys stored on separate computers, and it's not a bad idea to use a different passphrase for separate keys stored on the same computer, especially if they have different servers they can access. However, practically speaking, if your computer was compromised (ie keylogger etc) then it's game over anyway.
> Does increasing the amount of bits in a key really have an effect on the security of the key, or does it not make much difference in a real-world use?
Yes, it does make a difference, depending on what you mean by "real-world". Anyone less than a state-level actor will probably be unable to cost-effectively attack even a 1024 bit key, but that won't be true for long. We suggest 2048 bit keys if you are using RSA, with 4096 if you prefer extra security and don't mind slight latency during a connection, or ED25519 for keys on systems that support it. Generally the defaults are pretty good. We have a HOWTO for different OS's here: https://userify.com/docs/generating-ssh-keys-on-ec2/
> How much less secure is it to not use a passphrase on a key?
From the server's perspective, it's EXACTLY the same, but…
Commercial products exist for this purpose, such as Power Broker:
https://www.beyondtrust.com/products/powerbroker-identity-services-ad-bridge/
In addition, it's involved but possible for an experienced user to set up AD authentication on Linux.
All AD really amounts to is a database; the endpoint (computer, server, whatever) performs a query, AD produces a response. That can be as a simple as 'is this username/password combination valid?' to 'where in the domain does this computer fit and what rights does it have?' AD allows for other nice features like Group Policy enforcing consistent configuration on every desktop. It also implements Kerberos-based authentication for better security.
Ergo, the only security issue I can foresee is that the query is done over unsecured means; AD uses LDAP as its primary protocol, which in its native form is plaintext. So your computer could conceivably send plaintext login information over the wire. However, most sysadmins will disable this and only support LDAP over SSL (LDAPS) which is encrypted. Most Linux LDAP implementations support running it over SSL.
A second concern is that the Linux machine does not implement Kerberos, and instead uses the fallback to NTLM authentication; if this is the case, your sysadmins should have disabled it. Kerberos is supported on Linux, and is a bit more involved when joining a machine manually, but has equivalent security to Windows.
A Linux machine joined to AD is no less secure than a Windows…
All 3 customers detected it quickly on their own. It sounds from their blog posts that BeyondTrust and Cloudflare both had good alerting that immediately alerted them to the problem. It sounds like 1Password's alerting wasn't as good, and they got lucky that the impacted employee saw a suspicious email saying "here's the report you requested" thought "I didn't request that report" and reported the suspicious email to the security response team.
https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise/
https://blog.1password.com/okta-incident/
> Also seems prudent to get rid of passwords and move to Kerberos and SSH keys + 2FA. Anything else I'm missing?
This is a good path to go down anyway, despite the fact that Kerberos, for instance, is totally susceptible to 'pass the hash'[1] type attacks. Concentrate on things like Yubikey-based authentication. You can do SAML/OIDC2/mTLS and SSH with Yubikeys.
Eliminate passwords.
[1] - https://www.beyondtrust.com/resources/glossary/pass-the-hash-pth-attack
See also, https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
> We raised our concerns of a breach to Okta on October 2nd. Having received no acknowledgement from Okta of a possible breach, we persisted with escalations within Okta until October 19th when Okta security leadership notified us that they had indeed experienced a breach and we were one of their affected customers.
Yeah this is pretty basic information security terminology. An "attack" is any attempted intrusion, successful or not, damaging or not. If the threat actor managed to breach your defenses and gain unauthorized access, that's called an attack.
For some definitions:
https://www.beyondtrust.com/blog/entry/difference-between-a-threat-actor-hacker-attacker