News for hackers. Stuff that matters.

A comment on Ask HN: What do you use to build auth?. Parent comment

Re:Ask HN: What do you use to build auth? by jaeming on Thursday June 30, 2022 @02:25AM (#31929243)
Existing crypto libs like bcrypt, which I mentioned? Or are you talking about something more? The credential stuffing mention you make makes me think you must mean something more. Does Auth0 by default advise users that they are using breached emails/passwords? If that is default behavior then I agree it does add a shining point to their feature-set.
[ Parent | on HN ]
Re:Ask HN: What do you use to build auth? by dickhardt on Friday July 01, 2022 @10:12AM (#31946656)
Existing libs for JWTs and PKCE

Minimizing a credential stuffing attack requires detecting the attack and then adding captchas or other bot mitigation techniques.

[ Parent | on HN ]
Re:Ask HN: What do you use to build auth? by jaeming on Saturday July 02, 2022 @02:22AM (#31956734)
captcha integration is super easy and doesn't require a full auth integration service. Detecting a brute-force maybe less so maybe, though I get a lot of DDOS pretection for free with AWS & cloudfront. But I was more interested in the idea of letting users know they were trying to use a breached email/password on register or login. I've got that on bitwarden (password manager), though now days I just auto-generate any password.
[ Parent | on HN ]