3 ms·
In the modern systems, it is considered a bad idea to keep plaintext passwords anywhere. If Cognito is even a bit competent, they won't have the passwords to ex
by theamk 5y ago
In the modern systems, it is considered a bad idea to keep plaintext passwords anywhere. If Cognito is even a bit competent, they won't have the passwords to export. AWS official docs [0] confirm this: they use SRP [1] which has the property that "The password never leaves the client and is unknown to the server."
You said that you are working on Cognito competitor -- are you storing plaintext passwords in database? Is your service going to have user export containing passwords?
[0] https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow.html https://docs.aws.amazon.com/cognito/latest/developerguide/am...
[1] https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...
- mooreds 5y agoThanks for the response! Sorry, I was imprecise. Agree you should never store passwords in plaintext, 100%! We store hashed passwords, but allow people to export them (along with the salt and the hashing algorithm). We do this over a secure channel agreed to with the customer. It is their data, after all. Exporting these attributes lets folks import the passwords in such a way as to not require the user to reset their password. I don't see any way to get Cognito to export hashed passwords. In contrast, Auth0, another competitor, allows it if you open a support ticket. Instructions here: https://fusionauth.io/docs/v1/tech/guides/auth0-migration/#exporting-password-hashes https://fusionauth.io/docs/v1/tech/guides/auth0-migration/#e... EDIT: Made clear we coordinate the export over a secure channel.