3 ms·
With direct dependencies on Node.js modules, you outright prevent using other runtimes like Cloudflare workers, Deno, etc. Node has decent support for WebCrypt
by 9dev 2y ago
With direct dependencies on Node.js modules, you outright prevent using other runtimes like Cloudflare workers, Deno, etc.
Node has decent support for WebCrypto, for example, which renders all usages of node:crypto obsolete.
At this point, I’d also argue that anything not promoting PassKeys as the default method is on the wrong track.
- forty 2y agonode:crypto seems to be supported by Deno's compatibly layer
- dagmawibabi 2y agoBetter auth has passkeys
- bekacru 2y agoThe only place where "node" is necessary is for password hashing, and as there’s no cryptographically secure way to hash passwords on CF Workers or other edge runtimes it's not really an option. At this stage of the project, supporting Deno isn't a priority but for those not using email and password auth, CF Workers and other edge/serverless runtimes should work just fine
- trescenzi 2y agoIs there a reason the web crypto api doesn’t work? CF workers support it: https://developers.cloudflare.com/workers/runtime-apis/web-crypto/ https://developers.cloudflare.com/workers/runtime-apis/web-c... Most browsers support it: https://developer.mozilla.org/en-US/docs/Web/API/Crypto https://developer.mozilla.org/en-US/docs/Web/API/Crypto
- maxbond 2y ago(I am not a cryptographer.) None of the hashes available in webcrypto's digest() are suitable for storing passwords (eg it doesn't support argon2, scrypt, bcrypt, or PBKDF2). They are all SHA family hashes. https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... You can use PBKDF2 through the deriveKey() function. So you could use that to store passwords. However, this is the least preferred of the acceptable algorithms, and is only recommended for use in scenarios where you must follow a standard that mandates the use of PBKDF2.
- pmdfgy 2y agoYou can rename the project to "The most comprehensive authentication library for node" then.
- Danjoe4 2y agoNoone uses passkeys
- willio58 2y agoAs someone who literally jumps on any passkey I see given to me as an option - I hope people are using them because I just want to use them more. Passwords are dumb for most use cases. They’re okay if you follow best practices, the thing is 99% of people don’t. So most people re-use passwords, and if asked to create new ones they append a character or something ineffective. No thanks, just do a LiDar scan of my face and get me into Netflix please.
- mhuffman 2y ago>Passwords are dumb for most use cases. They’re okay if you follow best practices, the thing is 99% of people don’t. So most people re-use passwords, and if asked to create new ones they append a character or something ineffective. This may be dependent on your social. Everyone I know uses password managers, even at work. So they have different passwords for every account and browser/phone extensions or apps to fill them in.
- 9dev 2y agoThat only solves half of the problem though. Since many people do not use password managers (and thus potentially reuse their passwords, there's still an incentive to obtain stored password hashes. With passkeys, the public keys stored in any given provider's database are useless—so any provider switching to Passkeys rids themselves of a big attack vector. Just think about a possible feature without rainbow tables, large credential leaks, and so on. That's what Passkeys enable.
- radicalriddler 2y agoI mean, Cloudflare's done a lot of work in polyfilling a lot of node_compat stuff. The only one is generally password hashing. At this point, I just run up a service binding to a rust worker and hash it over there.