4 ms·
I always say the best piece of advice on this is, "Don't store passwords." Like shown in other comments, the landscape of what should be used changes frequentl
by kemiller2002 6y ago
I always say the best piece of advice on this is, "Don't store passwords." Like shown in other comments, the landscape of what should be used changes frequently. Truthfully, I haven't had to write anything that stores passwords for several years, and until now I hadn't heard of Argon2. That's frightening to me and shows how far out of the game I am now.
Finding a trusted 3rd party who's responsibility is to stay on top of it, is definitely the way to go if you're not in the security space. It's scary how many people don't understand the basics of hashing and encryption that have written authentication systems. When people ask me if we should do something like this, I normally say, "If you're asking me, then you probably already know the answer."
- t0astbread 6y agoCounterpoint: A dedicated "authentication party" is a privacy nightmare and a single point of failure. See https://news.ycombinator.com/item?id=25091420 https://news.ycombinator.com/item?id=25091420
- kemiller2002 6y agoVery true, there are drawbacks to using 3rd party authentication and I think a good (at least) middle ground is to purchase a hosted appliance that handles storage and authentication. Of course if you are a large organization that can hire people who do know what they are doing, you are golden. Sadly, these are not the companies that I generally interact with.
- t0astbread 6y agoOh, I think I misunderstood your comment. I thought you were referring to third-party auth specifically. Another option more on the cheaper side would be a library that handles algorithm selection and migration in a "black box" way. I.e. the public interface is only `db.put(user,newPass)`, `db.compare(user,suppliedPass)` and maybe something like `db.doMaintenance()`. You would need to handle storage yourself in that case but I don't see the downside of this when you are storing your users' data anyways. I'm not aware if such a library exists though.
- mooreds 6y agoSee also this list of vendors and open source projects (disclaimer, my employer is one): https://news.ycombinator.com/item?id=25212694 https://news.ycombinator.com/item?id=25212694 What hosted appliances offerings have you taken a look at?
- vbezhenar 6y agoWhat's the backup plan when 3rd party will ban your website because of any reasons?
- anamexis 6y agoSend people emails to reset their password with your new auth solution.
- fractionalhare 6y ago> Like shown in other comments, the landscape of what should be used changes frequently. It does not. I agree with you that you shouldn't store passwords if you don't have to, but bcrypt and scrypt are still absolutely fine. You do not need to choose Argon2. Cryptographic algorithms shouldn't be deprecated just because something new came out, they should only be deprecated when there is a specific, published cryptanalysis that weakens them.