Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What do you use for authentication and authorization?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 247 posts

Re: Ask HN: What do you use for authentication and authorization?

#121

Post by watty »

Deestan wrote: post #90

Professionals. Hire an expert. If you can't answer these questions yourself (which is fine - it's specialized knowledge separate from the skillset needed for building a useful application), you are lacking critical competence for coding anything handling health information. The security minefield is much much bigger than the login page.

Come on now, security isn't easy but it's not rocket science. If someone is competent enough to be developing applications they're certainly competent enough to do security correctly by researching first.

Re: Ask HN: What do you use for authentication and authorization?

#122

Post by TecoAndJix »

tinco wrote: post #79
yolo1 wrote: post #42

Earlier quoted context omitted.

This is called two factor auth. SMS is not considered a secure method of transport (mostly due to porting). It only solves opportunistic password compromise via password dumps.

It's not called two factor authentication. Two factor authentication is when you have two factors for authentication. This is just one..

something you have (phone) & something you know (password)

Re: Ask HN: What do you use for authentication and authorization?

#123

Post by 0xEFF »

yolo1 wrote: post #42
mattbgates wrote: post #35

Email or text message sent to customer and they just input the number they were sent to match.

This is called two factor auth. SMS is not considered a secure method of transport (mostly due to porting). It only solves opportunistic password compromise via password dumps.

Where’s the second factor?

Re: Ask HN: What do you use for authentication and authorization?

#124

Post by yebyen »

kilburn wrote: post #70
geezerjay wrote: post #56

Earlier quoted context omitted.

> Again, expiry is not revocation. Issue and expiration timestamps are used along with nonces to enforce single use tokens. Once a token is used then the client is expected to discard and refresh the token. Implementations are also free to keep track of issued tokens and that does not pose any problem in the real world. > And the jti field is not intended for what you think it is. Anti-replay is not at all the same a…

> Why are you expecting to revoke a token in a scenario where the token is supposed to be used once? An attacker was able to somehow issue a bunch of tokens for himself. Now you want to invalidate them even though they're not used yet. > Either the token is deemed valid and accepted or it's invalidated and rejected, which triggers clients to refresh the token and retry the request. The other point here is that you ar…

> An attacker was able to somehow issue a bunch of tokens for himself

I'm not expert in JWT and just jumping in here, but wouldn't that imply total compromise of the PKI if this ever happens?

I'm saying, if this scenario comes to pass, with basically any old authentication system, isn't it now time to roll the master keys and invalidate _every previously issued_ token/session the old-fashioned way, by disavowing the prior signing key, and then bouncing every user/ requiring to re-auth freshly and establish brand new sessions within the totally new PKI?

I assume this is always still possible even with JWT from what I've read so far, but I'm happy to be educated if either of you don't mind sharing.

Re: Ask HN: What do you use for authentication and authorization?

#125

Post by yebyen »

nindalf wrote: post #112
weego wrote: post #60

Earlier quoted context omitted.

That's just an argument ignoring the realities of scale. In any reasonable system the number of tokens that need to be held in blacklist until seen will be tiny in comparison to active sessions.

How does it matter how many tokens are in the blacklist? You're looking them up in a DB where the lookup time in lg(n) anyway. To give you an idea of how little it matters, let's say a small blacklist would be 10k tokens while a list of all tokens would 10M. log(10k) = 13.28. log(10M) = 23.25. It's only marginally more, because the main latency of the DB request is the network round-trip time. The actual issue here i…

I think the answer is supposed to be that you've done your architecture wrong if you ever allow a revoke list to grow as high as 10k or beyond. You should not have to grant very many long-lived JWT tokens to begin with, so for most revocations it should always be enough to simply let them expire.

If the token blacklist is budgeted and never allowed to grow to a size of more than say 10-200, then it can probably be safely maintained over the lifetime of the project in a way that doesn't require a round-trip, in the source code for the service or otherwise gated behind a release barrier.

I don't know if I agree with that (I've never implemented JWT) but at least I think I've heard of the idea that's how the architecture is supposed to be planned for JWTs.

Re: Ask HN: What do you use for authentication and authorization?

#126

Post by nothrabannosir »

inersha wrote: post #118
eximius wrote: post #116

Earlier quoted context omitted.

If they asked a bunch of doctors how anesthesia worked, they were just about to go perform surgery at home, you'd expect the doctors to warn that it was a bad idea, no?

I suppose there may be a distinction between asking "how does anaesthesia work?" and "should I perform surgery at home?".

"A is to B as X is to Y", compares A and X, not A and B. It puts A in the context of B, as X is in the context of Y.

the comparison is between "how does anaesthesia work?" (A) and "how does auth work?" (X), relative to "about to perform surgery at home" (B) and "about to implement a service containing medical information" (Y).

The point is: he's about to do something big, and is asking a basic question. The real problem is not the basic question (auth) but the context he's doing it in.

If a nurse in training, in a classroom setting, asked about anaesthesia, it'd be fine. If they're a doctor, about to operate on a live patient, it's different.

Re: Ask HN: What do you use for authentication and authorization?

#127

Post by dagoat »

mcbits wrote: post #18
aeleos wrote: post #12

Earlier quoted context omitted.

Isn't JWT also a type of bearer token? Could you please provide some more detailed arguments about why JWT shouldn't be used other than linking its wikipedia article?

JWT is fine if "revoke" isn't in your vocabulary for the service. If you do need to revoke tokens, JWT becomes a racey contraption that requires synchronizing and looking up state on every request, the avoidance of which was the main reason to use JWT in the first place.

I thought the problem with JWTs was the whole “stateless JWTs”.

Re: Ask HN: What do you use for authentication and authorization?

#128

Post by dagoat »

If you have the budget for it just use auth0 or similar. You will likely spend less time wiring it up than coming up with a solution yourself.

Going off your question only, this will also likely end up being the most secure implementation for you (relying on a third party service)

Re: Ask HN: What do you use for authentication and authorization?

#129

Post by michaelt »

nindalf wrote: post #112
weego wrote: post #60

Earlier quoted context omitted.

That's just an argument ignoring the realities of scale. In any reasonable system the number of tokens that need to be held in blacklist until seen will be tiny in comparison to active sessions.

How does it matter how many tokens are in the blacklist? You're looking them up in a DB where the lookup time in lg(n) anyway. To give you an idea of how little it matters, let's say a small blacklist would be 10k tokens while a list of all tokens would 10M. log(10k) = 13.28. log(10M) = 23.25. It's only marginally more, because the main latency of the DB request is the network round-trip time. The actual issue here i…

  How does it matter how many tokens are in the blacklist?
If you're authentication something internal to a company, like the link between the website and the order status backend, there may be literally one user with one token.

In this case, the list of revoked tokens will take little space, and update very rarely!

If you're authenticating users logging into your website and you decide user logouts should be implemented by token revocation, you're going to have a great many revoked tokens - perhaps within an order of magnitude of the number of active users you have.

I suspect a lot of the disagreement here is between people who are thinking of different situations.

Re: Ask HN: What do you use for authentication and authorization?

#130

Post by inersha »

nothrabannosir wrote: post #126
inersha wrote: post #118

Earlier quoted context omitted.

I suppose there may be a distinction between asking "how does anaesthesia work?" and "should I perform surgery at home?".

"A is to B as X is to Y", compares A and X, not A and B. It puts A in the context of B, as X is in the context of Y. the comparison is between "how does anaesthesia work?" (A) and "how does auth work?" (X), relative to "about to perform surgery at home" (B) and "about to implement a service containing medical information" (Y). The point is: he's about to do something big, and is asking a basic question. The real prob…

I like the analogy in your final paragraph. I see hacker news as the nurse in the classroom setting.
Post reply on HN