News for hackers. Stuff that matters.
Re:Best practices for user account, authorization and passwo... by CM30 on Saturday February 03, 2018 @08:59PM (#16300845)
Eh, I disagree with that. Using a third party solution for password management/account logins has its benefits, but it also has quite a lot of downsides too. Such as:

1. Forcing people to create an account on a service they don't use or trust to access your website. Remember, quite a lot of people despise Facebook and Google, and by forcing them to use those services, you're making them choose between their privacy and your service.

2. Giving said services too much leeway on how the setup works. Do Facebook or Google or Twitter or whoever now charge money to use their account login system? If so, tough luck; you're gonna have to either rework your whole system or pay up.

3. Giving said services too much control in general, and letting them centralise the internet. This is a bad thing for numerous related reasons, ranging from easy access to personal data for tyrants to dependence on a walled garden run by a large corporation).

4. Making them the world's number 1 target for hackers. Admittedly they're already likely this, and homegrown systems have their own security issues in this department, but I certainly don't like the idea that the whole of the internet is basically now compromised the minute a data breach hits Google or what not. Any centralised system is basically a giant bullseye for every bad actor on the planet.

So no, it's not necessarily accurate that no one should try and implement password management or account systems or farm it out to third parties. That's a good way to give whatever controls remains over to large corporations.

Re:Best practices for user account, authorization and passwo... by ben-schaaf on Saturday February 03, 2018 @09:35PM (#16300965)
I don't think its necessary for said third party solution to be a service. Most frameworks have builtin support or well written libraries that do the password management/login stuff for you.