Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things to Know When Making a Web Application in 2015

blog.venanti.us

Post reply on HN
Print view View original

11–20 of 186 posts

Re: Things to Know When Making a Web Application in 2015

#11

Post by patcheudor »

For mobile apps that use WebView and/or has the capability to execute javascript or any other language provided by any network available resource I'd like to add:

ALWAYS USE CRYPTOGRAPHY for communication! Simply doing HTTP to HTTPS redirects is not sufficient. The origin request must be via HTTPS. Also make sure the app is properly validating the HTTPS connection.

Sorry I had to shout, but I'm growing tired of downloading the latest cool app that is marketed as secure only to find that it doesn't use HTTPS and as a result I can hijack the application UI to ask users for things like their password, credit-card number, etc., all without them having any way to tell if they are being asked by some bad guy.

Re: Things to Know When Making a Web Application in 2015

#12

Post by venantius »

lstamour wrote: post #5
shiggerino wrote: post #3

>When storing passwords, encrypt them Nopenopenopenopenope! This is terrible advice. Don't do this. Remember what happened when Adobe did this?

I suspect, given the reference to sending verification emails, that hashing was what was intended here. As with the use of identity instead of authorization. To be clear, encryption implies you can retrieve the stored value later, while hashing is intended to be one-way.

I've fixed the language in question. Thanks all for the catch here.

Re: Things to Know When Making a Web Application in 2015

#13

Post by mcdougle »

ovi256 wrote: post #8
rfrey wrote: post #4

Earlier quoted context omitted.

The full quote is: "When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow." Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?

Of course one shouldn't encrypt them, one should salt and hash them. With a cryptographically secure hash such as bcrypt or scrypt. If you use a batteries-included web-framework, this is already done for you. If you do not, you better understand the tradeoff of redeveloping those parts.

I imagine the OP probably meant that and simply wrote the wrong thing in the post. I probably wouldn't have noticed it was the wrong wording if not for this comment chain.

Re: Things to Know When Making a Web Application in 2015

#14

Post by smt88 »

atwebb wrote: post #6
rfrey wrote: post #4

Earlier quoted context omitted.

The full quote is: "When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow." Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?

I think they're assuming it can be decrypted instead of one-way.

Encryption isn't encryption if it's one-way.

Re: Things to Know When Making a Web Application in 2015

#15

Post by jawshie »

>Confirm emails: When users sign up, you should e-mail them with a link that they need to follow to confirm their email.

And I think this should be the only verification done for email addresses aside from very basic structure. It is highly frustrating signing up for a service that does not allow address aliases (eg myemail+hackernews@gmail.com) because they don't think '+' belongs in an email address. I am already validating my address for you! Don't lose me as a customer because I don't trust you won't spam me.

>Encryption: For all of its problems with certificates, there's still nothing better than SSL.

SSL is deprecated. Use TLS.

And for the love of god, don't autoplay audio. There is no faster way for me to close your tab and never go to your site again.

Re: Things to Know When Making a Web Application in 2015

#18

Post by balls187 »

aikah wrote: post #16
shiggerino wrote: post #3

>When storing passwords, encrypt them Nopenopenopenopenope! This is terrible advice. Don't do this. Remember what happened when Adobe did this?

I think the OP meant "hash them" with something like bcrypt.

Which raises the question: should you follow web application advice regarding security from someone who mistakenly uses the word "Encrypt" when they (actually or unintentially) mean "Hash?"

Re: Things to Know When Making a Web Application in 2015

#19

Post by balls187 »

If you're new to web application development and security, don't blindly follow the advice of someone else who is also new to web application security.

You should instead have a security audit with people who have experience in security, so they can help you identify where and why you're system is vulnerable. If no one exists on your team/company that does, then hire a consultant.

Security is a hairy issue, and no single blog post/article is going to distill the nuances down in an easy to digest manner.

Post reply on HN