3 ms·
There are different sorts of hard bits IMHO. OAuth and OpenID Connect can be _conceptually_ hard; you are abstracting authentication and authorization into a p
by dwaite 7y ago
There are different sorts of hard bits IMHO.
OAuth and OpenID Connect can be _conceptually_ hard; you are abstracting authentication and authorization into a protocol and therefore inheriting someone else's model. When that model is presented in the form of a spattering of specifications, understanding and mapping to that model can be really laborious . You also may be doing this as part of a new architecture on your side (e.g. moving from traditional server-side rendered web applications to PWA/SPA apps using APIs).
Strong Authentication and Account Lifecycle Management actually are just a whole lot of logic. Authentication is also something which is continually evolving to stay ahead of attackers. They are hard from the perspective of amount of work required, the distraction from your actual product mission, and the consequence of getting them wrong.
- galaxyLogic 7y agoAnother thing that makes it hard I think is that these are all by necessity multi-agent protocols/algorithms. How should we unambiguously describe and specify them? Well verbal verbiage is not very formal. Maybe something like: https://en.wikipedia.org/wiki/Specification_and_Description_Language https://en.wikipedia.org/wiki/Specification_and_Description_... What makes this all rather critical is that these are security procedures and, and complexity is the foe of security.