5 ms·
Do you roll your auth and stuff?
by theonething 5y ago
Do you roll your auth and stuff?
- archerx 5y agoI made a custom e-commerce from scratch with PHP and doing the auth system wasn’t hard at all and it is pretty secure. I feel people make auth seem scarier than it really is.
- petewailes 5y agoDon't roll your own auth. I seriously doubt you're going to do a better job at security than the AaaS systems out there. I couldn't, and no-one I know could. It's a ludicrously complex and subtle field.
- dvdkon 5y agoHow did you evaluate the auth implementations? In my experience it's about as hard to poke holes into something as it is to fix it. Besides, a custom auth implementation doesn't need to be best-in-class, it needs to just be good enough.
- atatatat 5y ago> PHP > pretty secure Are you the admin of Demonoid?
- scrollaway 5y ago> the auth system wasn’t hard at all and it is pretty secure If there ever was a red flag in what you're saying, this is it. Auth isn't "scary". But it is hard. You need to know what you're doing in order to implement it from scratch. If you think it wasn't hard, odds are you did it wrong.
- adventured 5y agoI started building my own auth about 20 years ago and I've been learning and rolling (improving it) as I go. I've been using a structure that I've been iterating for about the past 6-8 years or so. Hardly a week has gone by that I haven't worked on something related to auth. I've experimented with just about every approach. Lately I've dumped all forms of social auth (the past couple of years). I won't allow FB or Twitter login, none of them deserve to be trusted with that. I'm a big fan of try (the service) before you have to sign up, but I always find that among the most challenging aspects to get right. I know everyone has a different opinion on auth, but I find it routine to do after all this time. The part I find most annoying is probably throttling / controlling abuse attempts vs legitimate users (balancing it well), it's tedious.