3 ms·
With all due respect, I think you're completely wrong about this. I do not assume that most developers are competent. In fact, when it comes to security, I ass
by Locke1689 16y ago
With all due respect, I think you're completely wrong about this. I do not assume that most developers are competent.
In fact, when it comes to security, I assume most developers are about two steps away from handing out root on request.
- patio11 16y agoSpeaking generally, I agree, competence is a risky assumption. It isn't risky about the SO devs: I've met some, they're sharp. They're certainly well-past sharp enough to get username/password working right. But OpenID is easy to screw up. Practically everyone has enormous problems with their implementations. (This goes seven times over for yours truly.) Which is (yet another) knock against choosing OpenID for anything important, versus systems which evidence exists can be implemented correctly. It is possible to bork username/password, but it is possible to implement it mostly correctly, too. I do not think it is possible to implement OpenID correctly. (For what it's worth, StackOverflow's is the best implementation I've seen from the user's perspective.)
- Locke1689 16y agoThe implementation issues comprise a very good point. Do you think this is solvable by better libraries? I've been working on my own solid implementation of OpenID for Django to plug-n-play with the built-in authentication system. Can it be saved and, if not, what's the alternative? Teach developers about bcrypt?