4 ms·
These security nightmares begs the question: Why don't databases use asymmetric keys and authenticate & authorize access? Why are we still reliant on password b
by aloknnikhil 7y ago
These security nightmares begs the question: Why don't databases use asymmetric keys and authenticate & authorize access? Why are we still reliant on password based authentication? If it's simply the question of key management and distribution, that's a solved problem.
- ownagefool 7y agoNot all databases require passwords to authenticate. I'd imagine most popular ones don't nowadays. https://www.postgresql.org/docs/12/client-authentication.html https://www.postgresql.org/docs/12/client-authentication.htm... I imagine developing something like equifax today, you'd want to hook up it up to your SSO, and used row based security so a user can only read their row, and then you focus your efforts making sure user accounts, especially privileged ones such as staff, aren't being abused. (You'd still probably establish system to system level trust, such as keys between your API and DB). But it's so much easier and cheaper just to connect using a username and password, and then do whatever the framework you chose does by default.
- cdelsolar 7y agohttp://begthequestion.info/ http://begthequestion.info/
- q3k 7y agoCockroachDB basically requires you to use mTLS to authenticate. It's fantastic.