3 ms·

I agree that it's better to avoid storing user credentials, but what do you suggest instead to authenticate the user?

by ngrilly 11y ago

balls187 11y ago
If you don't require privileged elevation, then I'm a fan of just using an email address and send "magic links" + persistent (but expiring) sessions. For mobile apps, I think using SMS and One-Time Passwords is sufficient as well. You can also use a delegated auth system put in place by OAuth v2, or something like Google Accounts, Twitter, etc. Those services do get pushback, as not every uses Gmail (or likes to give any run of the mill app access to Google account data).
- ngrilly 11y ago
  > If you don't require privileged elevation What do you mean by privileged elevation (I'm talking in the context of a web app)? > just using an email address and send "magic links" + persistent (but expiring) sessions Do you mean something similar to what Medium does? https://medium.com/the-story/signing-in-to-medium-by-email-aacc21134fcd https://medium.com/the-story/signing-in-to-medium-by-email-a... I like it too. But what about delays in receiving emails (when I suggested this approach to some customers, they were worried about that)? > You can also use a delegated auth system Yes, outsourcing the authentication is another solution, but some (most?) users are not comfortable with giving so much power to Google/Twitter/GitHub/etc. (as you wrote in your comment).
  - balls187 11y ago
    > What do you mean by privileged elevation (I'm talking in the context of a web app)? For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session. > I like it too. But what about delays in receiving emails (when I suggested this approach to some customers, they were worried about that)? Combo of email & SMS. As Bruce Schneier has written, security is usually a trade off of user experience.
    - ngrilly 11y ago
      > For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session. Why not reauthenticate by sending a one time password by email/SMS (instead of asking for a password)? > Combo of email & SMS. Good idea. I was also thinking of sending one time passwords through some chat applications like WhatsApp, but most of them have no API for such a thing (except Telegram).
    - ngrilly 11y ago
      > Combo of email & SMS In France, where I have most of my customers, the SMS is paid by the sender, which makes it expensive.

I agree that it's better to avoid storing user credentials, but what do you suggest instead to authenticate the user?

by ngrilly 11y ago

I agree that it's better to avoid storing user credentials, but what do you suggest instead to authenticate the user?

If you don't require privileged elevation, then I'm a fan of just using an email address and send "magic links" + persistent (but expiring) sessions. For mobile apps, I think using SMS and One-Time Passwords is sufficient as well. You can also use a delegated auth system put in place by OAuth v2, or something like Google Accounts, Twitter, etc. Those services do get pushback, as not every uses Gmail (or likes to give any run of the mill app access to Google account data).

ngrilly 11y ago
> If you don't require privileged elevation What do you mean by privileged elevation (I'm talking in the context of a web app)? > just using an email address and send "magic links" + persistent (but expiring) sessions Do you mean something similar to what Medium does? https://medium.com/the-story/signing-in-to-medium-by-email-aacc21134fcd https://medium.com/the-story/signing-in-to-medium-by-email-a... I like it too. But what about delays in receiving emails (when I suggested this approach to some customers, they were worried about that)? > You can also use a delegated auth system Yes, outsourcing the authentication is another solution, but some (most?) users are not comfortable with giving so much power to Google/Twitter/GitHub/etc. (as you wrote in your comment).
- balls187 11y ago
  > What do you mean by privileged elevation (I'm talking in the context of a web app)? For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session. > I like it too. But what about delays in receiving emails (when I suggested this approach to some customers, they were worried about that)? Combo of email & SMS. As Bruce Schneier has written, security is usually a trade off of user experience.
  - ngrilly 11y ago
    > For example, prior to changing account settings, reauthenticate the users, regardless if they have a valid session. Why not reauthenticate by sending a one time password by email/SMS (instead of asking for a password)? > Combo of email & SMS. Good idea. I was also thinking of sending one time passwords through some chat applications like WhatsApp, but most of them have no API for such a thing (except Telegram).
  - ngrilly 11y ago
    > Combo of email & SMS In France, where I have most of my customers, the SMS is paid by the sender, which makes it expensive.