Okta emailed me trying to sell their SSO gubbins.

I actually quite like the idea of being able to abstract away all the providers people might want to log in with, and making it someone else's job to check whether those providers are trustworthy.

But the email is copied to every permutation of my name/surname/initials etc @mydomain.com.

They had no legitimate way to obtain my email address for marketing purposes, so they just guessed it.

And I'm supposed to believe no corners will be cut and no bodges applied in making sure the user is who he claims to be?