5 ms·

I was just having this conversation at work… How is it difficult to get web application authentication wrong at this point? It’s super well tread territory. Ad

I was just having this conversation at work… How is it difficult to get web application authentication wrong at this point? It’s super well tread territory. Add your spices, a sprinkle of cookie crumbs, a token here or there, and then 2 hours in the oven and you’re done! And that’s rolling it entirely by hand. Most web frameworks have middleware that get you going in minutes.

pier25 3y ago
> How is it difficult to get web application authentication wrong at this point? Adding a log in to an app is no big deal but there are more complex scenarios to consider. Maybe single auth to multiple services, SSO, 2FA, OTP, Oauth, etc.
- techdragon 3y ago
  This is literally the only value add in my mind. When you know it’s not just one simple app. When you know you’ve going to have frontends and backends and server to server tokens and third party and SSO and all the other TLA soup… then it starts to be something where im going “how much time could this save, would this be a good idea”
infamouscow 3y ago
Often it's really about positioning the business to minimize and avoid liability and risk of lawsuits, which is orthogonal to security. It's not a satisfying answer, but none of this will change until the public feels so strongly about this problem they become single-issue voters electing legislators to pass radically different laws.
- wdb 3y ago
  But does a Okta or Azure AD etc take the liability, though?
JonChesterfield 3y ago
Would Okta be one of the things you can use to get authentication right in a few minutes? Aside from the whole Okta themselves don't know how to do this security lark thing that is
deleted 3y ago
[deleted]
raxxorraxor 3y ago
> How is it difficult to get web application authentication wrong at this point? It’s super well tread territory Implementing an auth flow to specification isn't trivial at all and that is a problem. Authn and authz get mixed up, people not checking tokens or their expiration, etc pp. There is probably a minefield of security issues here and some of those come to be because it is too complicated. Sure, there is middleware with sensible service integration, but you still need to do a lot of legwork in any case.

pier25 3y ago

> How is it difficult to get web application authentication wrong at this point? Adding a log in to an app is no big deal but there are more complex scenarios to consider. Maybe single auth to multiple services, SSO, 2FA, OTP, Oauth, etc.

techdragon 3y ago
This is literally the only value add in my mind. When you know it’s not just one simple app. When you know you’ve going to have frontends and backends and server to server tokens and third party and SSO and all the other TLA soup… then it starts to be something where im going “how much time could this save, would this be a good idea”

infamouscow 3y ago

Often it's really about positioning the business to minimize and avoid liability and risk of lawsuits, which is orthogonal to security. It's not a satisfying answer, but none of this will change until the public feels so strongly about this problem they become single-issue voters electing legislators to pass radically different laws.

wdb 3y ago
But does a Okta or Azure AD etc take the liability, though?

JonChesterfield 3y ago

Would Okta be one of the things you can use to get authentication right in a few minutes? Aside from the whole Okta themselves don't know how to do this security lark thing that is

deleted 3y ago

[deleted]

raxxorraxor 3y ago

> How is it difficult to get web application authentication wrong at this point? It’s super well tread territory Implementing an auth flow to specification isn't trivial at all and that is a problem. Authn and authz get mixed up, people not checking tokens or their expiration, etc pp. There is probably a minefield of security issues here and some of those come to be because it is too complicated. Sure, there is middleware with sensible service integration, but you still need to do a lot of legwork in any case.