Millions of accounts compromised because there is no specialised user database

Re:Millions of accounts compromised because there is no spec... by andrewstuart on Tuesday April 21, 2015 @10:28PM (#9418366)

Does OpenLDAP meet the stated need for a minimal solution that does nothing else apart from the small set of required functions?

I get the impression that OpenLDAP is a big beast that does much, much more.

I'm wanting a fast motorbike and you're pointing at a 16 wheel heavy hauler saying "see, same thing, the hauler has at least two wheels and an engine".

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by Spooky23 on Tuesday April 21, 2015 @10:38PM (#9418398)

Note I didn't endorse OpenLDAP at all. Not sure if that's the best solution -- I'd probably steer towards 389 server or something similar with Netscape heritage.

You also said:

"Another problem is that developers roll their own user and password management systems and get things like salting and hashing wrong, making the data vulnerable."

You're asking for a distributed, secure system for processing user data and credentials. The most common systems in production globally for doing this (Microsoft Active Directory) are based on technologies developed in the 80's and only being supplanted in recent years. There's a reason for that, and if it were a trivial problem, we wouldn't have pervasive solutions using 1980s RPC in 2015 still running most businesses!

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by untog on Tuesday April 21, 2015 @10:38PM (#9418400)

There is sometimes a reason for a piece of software being large. Security is one of those reasons.

If you want a secure system you shouldn't be prioritising a "minimal solution". As the previous poster said, don't reinvent the wheel.

[ Parent | on HN ]