Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Any comprehensive courses on Auth?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 93 posts

Re: Ask HN: Any comprehensive courses on Auth?

#12

Post by jonasmerlin »

withinboredom wrote: post #6

Huh, I always forget a lot of programmers weren't around when this stuff was invented. It's all actually pretty simple, and very little complexity. However, there are so many "gotchas" (that can result in zero security) that anyone writing a guide like this would probably have you sign a waiver, then any company you work for sign a waiver, and include your firstborn child. For example, user/pass is pretty simple on t…

Actually, I think we're doing a huge disservice to our profession as programmers when we call stuff like this "an insane number of gotchas". This is no critique of you or your post specifically, mind you, and I know where you're coming from. But it's a critique of a general tendency among programmers to call anything that requires a bit of knowledge and thought beyond the simplest surface level solution "complex" or "insane to implement on your own". It's not. While I know that you're list of gotchas isn't exhaustive, the real list is not so much longer that it's not perfectly reasonable to expect someone to be able to implement it correctly.

I say that as someone who was on the "receiving end" of this kind of advice for years btw. I always thought that the things that are "better left to libraries" are really arcane and impossible to understand, which only lead to confusion and an inability to truly assess options. And it's really just a matter of semantics and framing. It would be perfectly reasonable to say "it's not complex as long as you keep this reasonably long list of gotchas in mind".

Re: Ask HN: Any comprehensive courses on Auth?

#13

Post by hobo_mark »

vindex10 wrote: post #10
withinboredom wrote: post #6

Huh, I always forget a lot of programmers weren't around when this stuff was invented. It's all actually pretty simple, and very little complexity. However, there are so many "gotchas" (that can result in zero security) that anyone writing a guide like this would probably have you sign a waiver, then any company you work for sign a waiver, and include your firstborn child. For example, user/pass is pretty simple on t…

I would add: * on the client side, store the token as a secure https only cookie, as local storage is accessible by any module of your app, see supply-chain attacks. * be extra careful with oAuth [1] * for APIs, be strict with CORS [2] [1] https://salt.security/blog/oh-auth-abusing-oauth-to-take-ove... [2] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

I'm having to deal with this stuff right now. Firebase stores their refresh token in local storage and that allows minting new session tokens once they expire, are they wrong? Is there any other way to remain signed in "forever"? (until logout or until token is revoked)

Re: Ask HN: Any comprehensive courses on Auth?

#14

Post by treffer »

One thing that might be interesting is SASL has evolved over the years. Most things are RFCs, so well written, short and open specifications. This gives you one larger thing to learn. Should be rather linear if you sort by RFC number.

It would head well into advanced user/password schemes.

The problem is that even advanced mechanism like a SCRAM based authentication with additional 2fa are rather simple to grasp & implement, but really hard to get right / secure.

A lot of the evolution is rather an evolution of attacks and issues, leading to new schemes. OWASP is thus pretty relevant, too.

Re: Ask HN: Any comprehensive courses on Auth?

#15

Post by cpach »

nevon wrote: post #2

I'm also interested in this, but specifically something that covers authentication between services and in particular situations where a user authenticates against service a and now service a needs to ask service b to do something on behalf of the user. Not just a handwavy "use OAuth" but more concrete and thorough.

For an overview, you might like these two articles:

https://www.lvh.io/posts/a-childs-garden-of-inter-service-au...

https://fly.io/blog/api-tokens-a-tedious-survey/

Re: Ask HN: Any comprehensive courses on Auth?

#16

Post by rtrblsm »

krantic wrote: post #7

I have not seen a course that covers all of the things you are asking for. The best courses on the oidc/oauth and saml I have seen were the paid ones here: https://www.hackmanit.de/en/training/portfolio On linkedinlearning this one was quite ok: https://www.linkedin.com/learning/web-security-oauth-and-ope... Free ressources check: - https://aaronparecki.com/ -OAuth 2.0 and OpenID Connect (in plain English): https://m…

all of that, plus the rfcs for oauth2 and oidc are pretty great as well!

Re: Ask HN: Any comprehensive courses on Auth?

#19

Post by joshxyz »

none.

but useful stuff:

certified ethical hacker course can give you a perpetrator's pov on how people get hacked.

owasp cheatsheet and latacora blog are useful reference also.

understanding how companies offer these services also helps, e.g. clerk.com, ory.sh, auth0, okta, supertokens, etc.

understanding how authentication coincides with authorization helps too.

Post reply on HN