Millions of accounts compromised because there is no specialised user database

Re:Millions of accounts compromised because there is no spec... by nedmcclain on Tuesday April 21, 2015 @11:51PM (#9418585)

My beta-quality Golang version of this with pluggable backends, including S3: https://github.com/nmcclain/glauth I would love suggestions/help.

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by andrewstuart on Wednesday April 22, 2015 @12:31AM (#9418665)

Ned - would you mind replying to this with a list of the features specified in the blog post and a YES/NO to confirm which are supported by your code?

thanks

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by nedmcclain on Wednesday April 22, 2015 @11:44AM (#9421234)

It should be accessible only via its specialised API which is designed to constrain the ways that it is accessed. YES - API is LDAPS.

It should not provide generalised database query functionality. YES - it only proivdes the subset of LDAP functionality necessary for authentication.

Its API should have password salting and hashing built in. NO - hashed but needs salting&scrypt.

Its API should throttle access with some sort of algorithm designed to prevent downloads of large quantities of user data. NO - todo.

It should encrypt data internally. YES (hashed not encrypted).

It should communicate only over encrypted connections. YES.

It should be distributed. YES.

It should not be run on any web server, should run "behind the scenes" and be accessible only via its API. YES.

It should include triggers and alerts based on uncommon access patterns or recognised nefarious access patterns. NO - todo.

It should have no other purpose. YES.

[ Parent | on HN ]