Things to Know When Making a Web Application in 2015
blog.venanti.us
Things to Know When Making a Web Application in 2015
1–10 of 186 posts
Re: Things to Know When Making a Web Application in 2015
#2> If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow.
OAuth isn't identity management, it's for authorization.
Each of those platforms does provide it's own identity management, but that isn't OAuth.
Re: Things to Know When Making a Web Application in 2015
#3>When storing passwords, encrypt them
Nopenopenopenopenope!
This is terrible advice. Don't do this. Remember what happened when Adobe did this?
Re: Things to Know When Making a Web Application in 2015
#4>When storing passwords, encrypt them Nopenopenopenopenope! This is terrible advice. Don't do this. Remember what happened when Adobe did this?
The full quote is:
"When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow."
Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?
Re: Things to Know When Making a Web Application in 2015
#5>When storing passwords, encrypt them Nopenopenopenopenope! This is terrible advice. Don't do this. Remember what happened when Adobe did this?
I suspect, given the reference to sending verification emails, that hashing was what was intended here. As with the use of identity instead of authorization. To be clear, encryption implies you can retrieve the stored value later, while hashing is intended to be one-way.
Re: Things to Know When Making a Web Application in 2015
#6>When storing passwords, encrypt them Nopenopenopenopenope! This is terrible advice. Don't do this. Remember what happened when Adobe did this?
The full quote is: "When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow." Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?
I think they're assuming it can be decrypted instead of one-way.
Re: Things to Know When Making a Web Application in 2015
#7Earlier quoted context omitted.
The full quote is: "When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow." Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?
I think they're assuming it can be decrypted instead of one-way.
Encryption means encrypting information which can later be decrypted. If you are talking about a one-way transform of data that you can never retrieve the original information from the result of the transformation, that is called hashing. We hash passwords, not encrypt them.
Re: Things to Know When Making a Web Application in 2015
#8>When storing passwords, encrypt them Nopenopenopenopenope! This is terrible advice. Don't do this. Remember what happened when Adobe did this?
The full quote is: "When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow." Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?
Of course one shouldn't encrypt them, one should salt and hash them. With a cryptographically secure hash such as bcrypt or scrypt.
If you use a batteries-included web-framework, this is already done for you. If you do not, you better understand the tradeoff of redeveloping those parts.
Re: Things to Know When Making a Web Application in 2015
#9>When storing passwords, encrypt them Nopenopenopenopenope! This is terrible advice. Don't do this. Remember what happened when Adobe did this?
The full quote is: "When storing passwords, encrypt them first, using an existing, widely used crypto library. If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow." Can you elaborate on what's so "nope" about that advice? Are you saying one shouldn't encrypt passwords?
That is correct. You should not store passwords in any form ... even encrypted.
You should either store only the salted hash value, or outsource the identity management to a third party who knows not to store the users passwords. :)
Re: Things to Know When Making a Web Application in 2015
#10> If you can get away with it, outsource identity management to Facebook / GitHub / Twitter / etc. and just use an OAuth flow. OAuth isn't identity management, it's for authorization. Each of those platforms does provide it's own identity management, but that isn't OAuth.
I think he may have confused OAuth with OpenID (which are often used in a complementary fashion).