3 ms·
What? No! There are plethora of mistakes one can make in implementing AuthN/AuthZ, and many of them almost immediately will lead to either the direct leak of P
by hobofan 1y ago
What? No!
There are plethora of mistakes one can make in implementing AuthN/AuthZ, and many of them almost immediately will lead to either the direct leak of PII or can form the start of a chain of exploits.
Storing password hashes in an inappropriate manner -> BOOM, all your user's passwords are reversible and can be used on other websites
Not validating a nonce correctly -> BOOM, your user's auth tokens can be re-used/hijacked
Not validating a session timestamps correctly -> BOOM, your outdated tokens can be used to gain the users PII
- vmg12 1y agoNone of those things are difficult to do correctly.
- hobofan 1y agoYeah, one would think so. Evidence in the wild shows otherwise.
- gjsman-1000 1y agoPlenty of evidence in the wild also shows that programmers in general should never be trusted.
- programmarchy 1y agoWith 5M you can get white hat audits. Even big boys like Okta have had serious fuckups [1]. [1] https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username/ https://trust.okta.com/security-advisories/okta-ad-ldap-dele...
- stephenr 1y ago> Storing password hashes in an inappropriate manner The problem isn't how you store the hash it's how you generate the hash.
- gjsman-1000 1y agoThe short answer: Bcrypt with 12 rounds. Good enough for almost any startup in 2025.
- Intermernet 1y agoArgon2 with defaults. Stronger and easier.
- quacksilver 1y agoCounterexample: Storing the bcrypt hash by appending it to a CSV file containing the usernames and hashes of all users then having a login process where that CSV file is downloaded to the client and the password is verified locally against that CSV file using client-side JavaScript would probably be very bad. Cryptography part is fine but storage or the auth process isn't. You would like to think that no-one would write their app that way, but there are plenty of slightly less worse things that happen in practice and vibe coding probably introduces all sorts of new silliness.
- deadbabe 1y agoSo it’s a bad idea, but somehow a guy in Ethiopia writes his own auth and builds a whole company around it and gets $5 million?
- koakuma-chan 1y agoHe must be really good at selling lol
- 6510 1y agoEverything in life is hard there.
- hobofan 1y agoI'm not criticizing BetterAuth here, but the idea that rolling your own auth is easy. BetterAuth is likely an improvement against the status quo for many companies if they have already decided to roll their own auth, as it at least already provides pre-made blocks of functionality that are hopefully battle-hardened rather than building completely from scratch.
- vasco 1y agoAn improvement if their own approach would be worse than 'get a single self taught guy to roll something out'. If it's roughly the same it shouldn't be any improvement.
- deadbabe 1y agoIt’s not easy, but it’s not impossible either. If you’re just a developer who works on CRUD apps all day or never touches a backend then yea you probably don’t have the skills but auth is a solved problem and you can learn to do it right. A team of engineers can definitely put together an auth system.