4 ms·
I was forced to use sign in with google for dnd beyond as they don't support byo-email address (!), only google, twitch, apple, and yahoo. We need a name and s
by Multicomp 6y ago
I was forced to use sign in with google for dnd beyond as they don't support byo-email address (!), only google, twitch, apple, and yahoo.
We need a name and shame site for websites that can't be bothered to write a back end database for the 3 columns needed to store emails, salts, and hashes.
- ayende 6y ago2FA, reset your password, making sure that password emails gets through, preventing login enumeration, preventing dictionary attacks, etc. Those are just the things off the top of my head, it's not just three columns
- kevincox 6y agoRate limiting is also a big one.
- Multicomp 6y agoThat reinforces the point of the article, but is semi-orthogonal to my point. Convenience strikes again. They use the google third party sign in since a big company like dnd can't be bothered to implement 3 columns plus your nice to haves. And they are nice to haves, arguably obvious and easily upgraded to required table stakes, but not _required_ to implement email-based sign in. The first three of your listed iftems are also effectively mitigated with a password manager.