The definitive guide to forms based website authentication
stackoverflow.com
The definitive guide to forms based website authentication
1–10 of 74 posts
Re: The definitive guide to forms based website authentication
#2As a rule most security advice on stack overflow is dangerously wrong. It's just not a good topic for the site, because consensus if often wrong in such complicated question.
I don't see anything obviously wrong with this particular article (aside from challenge response or SSL choice - one should just always use SSL, and if you can't, then seek professional advice), however I am still apprehensive of the hive mind.
Re: The definitive guide to forms based website authentication
#3I hope this gains traction before it's closed as subjective or such...
Re: The definitive guide to forms based website authentication
#4it's mostly good. NIST abolished their algo for pasword entropy estimation some time ago. i do not much like any password strength tests, most of which rate any number of terrible passwords as strong. as such i think they give a false sense of security. maybe consider cracklib.
as DenisM said, always use SSL for all traffic if security matters and don't trust SO for security advice.
Re: The definitive guide to forms based website authentication
#5As a rule most security advice on stack overflow is dangerously wrong. It's just not a good topic for the site, because consensus if often wrong in such complicated question. I don't see anything obviously wrong with this particular article (aside from challenge response or SSL choice - one should just always use SSL, and if you can't, then seek professional advice), however I am still apprehensive of the hive mind.
There was some information in there about SRP being patented that I thought was misleading. It is patented, but it's freely licensed.
Re: The definitive guide to forms based website authentication
#6it's mostly good. NIST abolished their algo for pasword entropy estimation some time ago. i do not much like any password strength tests, most of which rate any number of terrible passwords as strong. as such i think they give a false sense of security. maybe consider cracklib. as DenisM said, always use SSL for all traffic if security matters and don't trust SO for security advice.
The only really useful password strength test would be one that said "A stock Thinkpad would be able to brute force this password in $x hours and $y minutes."
Might make people think twice about that six character password.
Re: The definitive guide to forms based website authentication
#7In the article they talk about the 500 worst passwords of all time. Here is a gist listing those passwords. https://gist.github.com/4033452
Might be useful for some of you.
Re: The definitive guide to forms based website authentication
#8In the article they talk about the 500 worst passwords of all time. Here is a gist listing those passwords. https://gist.github.com/4033452 Might be useful for some of you.
That list was more obscene than I figured it would be.
Re: The definitive guide to forms based website authentication
#9Where I work we use something simple like kerberos/basic/digest/custom http header authentication on our apps, and then put Apache with mod_auth_form in front of it (or ISA server).
I even wrote an authentication reverse proxy[1] in java in my spare time, so I can use that to publish my apps, and have SSO across all of them (until BrowserID becomes mainstream that is). This way I centralized the cookie auth problem, and don't need to care about it in every app.
Re: The definitive guide to forms based website authentication
#10I love the attention to usability in the first answer.