Re:Best practices for user account, authorization and passwo...
by always_good on Sunday February 04, 2018 @09:22AM
(#16302811)
Maybe that's good advice for a beginner, but I don't see how you can say that seriously as a professional.
Authentication is such a core part of the UX of your product. You should know how it works. If you're factoring out to a black box because you couldn't do it yourself, then I'm not convinced you're any more secure.
If your team is too incompetent to do it correctly (there are so many resources online), then how are they going to do anything else correctly, like ensure I can't access your private messages when I change /<my_id>/messages to /<your_id>/messages in the URL bar, or query the database without sqli?
This "don't do it, it's too hard" meme does nothing but scare people away from core competencies of our profession.
Authentication is such a core part of the UX of your product. You should know how it works. If you're factoring out to a black box because you couldn't do it yourself, then I'm not convinced you're any more secure.
If your team is too incompetent to do it correctly (there are so many resources online), then how are they going to do anything else correctly, like ensure I can't access your private messages when I change /<my_id>/messages to /<your_id>/messages in the URL bar, or query the database without sqli?
This "don't do it, it's too hard" meme does nothing but scare people away from core competencies of our profession.