3 ms·
>I agree that things should be much better but until there is a book of "this is the right way to do signup/signin/account reset/ etc. " then most of us are try
by jaclaz 4y ago
>I agree that things should be much better but until there is a book of "this is the right way to do signup/signin/account reset/ etc. " then most of us are trying to do things the best way we know how to and sometimes bad things happen.
And when these (hopefully rare) bad things happen (and are documented and reproducible) what do you propose, do nothing and wait some more until that book is published by someone?
Or take note of what happened (useful to later publish the "other" book "these are the wrong ways to do signup/signin/account reset/ etc. ") and quickly implement a remedy for the found issue?
- lbriner 4y agoMy argument is that the blanket "enforce it with laws" is meaningless until this document exists. I'm not saying that I don't practice security in my apps or that no-one should, just that the law (right now) is not the right tool to fix this problem.