Millions of accounts compromised because there is no specialised user database
fourlightyears.blogspot.com
Millions of accounts compromised because there is no specialised user database
1–10 of 61 posts
Re: Millions of accounts compromised because there is no specialised user database
#2Great post, and something I've been thinking about for quite some time. Would love to see an open source framework made available that simplifies many of the nuances necessary to maintain a "secure" user database.
Don't get me wrong, this won't solve everything, but in my opinion it's a pretty big step in the right direction.
Re: Millions of accounts compromised because there is no specialised user database
#3The problem with this assertion is that this data still has to hit persistent storage somehow. Should that be in an arbitrary binary format? How should it be indexed for constant-time access? Essentially the problems that a specialized user database would need to solve would mean re-implementing exactly what generalized databases are built to do.
It's not a problem of how it's being stored. It's a problem of what is being stored.
I would suggest that the world doesn't need a specialized database for this, it needs killer libraries that make all necessary operations dead simple with any backend. And they should be dead simple to find and install.
More fundamentally, though, I'm not sure this problem is entirely solvable. Even with all the libraries and informational websites in the world, if developers don't go out and look for that information (and find the right stuff), they may never know they're doing anything wrong.
P.S. Hello again, alter ego.
Re: Millions of accounts compromised because there is no specialised user database
#4The problem with this assertion is that this data still has to hit persistent storage somehow. Should that be in an arbitrary binary format? How should it be indexed for constant-time access? Essentially the problems that a specialized user database would need to solve would mean re-implementing exactly what generalized databases are built to do. It's not a problem of how it's being stored. It's a problem of what is…
I'd be happy to have any sort of alternatives for approaching this problem. Currently there's nothing designed to give me a way to implement a lightweight hack-resistant user database.
Re: Millions of accounts compromised because there is no specialised user database
#5Wesabe is a good way to store sensitive user data
Re: Millions of accounts compromised because there is no specialised user database
#6OP here. It's a fairly simple concept - any wizards with a few spare hours willing to try to put a prototype together today?
From HN front page to solution within hours!
If it said "built with Golang" or "built with Rust" it would certainly hit the front page.
Re: Millions of accounts compromised because there is no specialised user database
#7There is such a beast, it's called LDAP. There are any number of directory and authorization services, and they have probably been around for decades.
There are dozens of directory server options, and probably a few dozen secure authorization solutions, from Kerberos and SAML to proprietary solutions like SiteMinder. Together, these solutions give you EIAM capability that does what you described.
Re: Millions of accounts compromised because there is no specialised user database
#8 "What developers need is a minimal, single purpose database specifically designed for protecting user information and designed to move user data access away from the rest of the application data to minimise the impact of access by hackers." - Yea this sort of homogenization of security worked great for OpenSSL
Re: Millions of accounts compromised because there is no specialised user database
#9There is such a beast, it's called LDAP. There are any number of directory and authorization services, and they have probably been around for decades. There are dozens of directory server options, and probably a few dozen secure authorization solutions, from Kerberos and SAML to proprietary solutions like SiteMinder. Together, these solutions give you EIAM capability that does what you described.
My uninformed perception of OpenLDAP is that it is a large, generalised enterprise class directory service that does alot of stuff. The post suggests a minimal, lightweight user database that does nothing at all else - is that the same thing as OpenLDAP?
Re: Millions of accounts compromised because there is no specialised user database
#10"What developers need is a minimal, single purpose database specifically designed for protecting user information and designed to move user data access away from the rest of the application data to minimise the impact of access by hackers." - Yea this sort of homogenization of security worked great for OpenSSL
I'd argue that it worked exactly as expected. The bug was found, fixed, and patches released immediately. For most people that was just a package-manager update away.
If anybody imagined that openssl had no bugs, they've obviously been proven wrong several times already, and I'm sure they will be proven wrong again.
The point of a single library (or few libraries) is (at least) twofold. It's much less likely to have defects, and when those defects that remain are found, answering the "does this affect me" question is easier and prompts quick action.