|
Daniel Pfeffer wrote: The problem with rolling your own password database is that you have to do it right - encryption, security, etc. Note that in many jurisdictions, any database that contains personally-identifiable information requires extra precautions. Ignoring them can cost you big bucks/euros/...
Yep. And that is why i want to avoid it. it's a lot of work and not that many befits. Usually if i see a option to use Google/FB/MS i take that. But again i have a dummy account just for that. I am not sure if most guys do take that option or not.
|
|
|
|
|
CS2011 wrote: Usually if i see a option to use Google/FB/MS i take that. But again i have a dummy account just for that. I am not sure if most guys do take that option or not.
That is up to them. Creating an additional account is not exactly rocket science...
Freedom is the freedom to say that two plus two make four. If that is granted, all else follows.
-- 6079 Smith W.
|
|
|
|
|
Without a rock-solid reason do not get into building your own user management system...
"The greatest enemy of knowledge is not ignorance, it is the illusion of knowledge". Stephen Hawking, 1942- 2018
|
|
|
|
|
The other option I've not seen mentioned here is running your own LDAP rather than rolling a database. Every cloud service I've looked at offers the option of spinning up an AD server. It requires a little bit of compliance and maintenance, but it scales well and addresses a number of security concerns out of the box.
"Never attribute to malice that which can be explained by stupidity."
- Hanlon's Razor
|
|
|
|
|
CS2011 wrote: would you guys will be willing to use a website where only way to authenticate is using either Google/FB/MS account ?
It can be quite convenient. As others have said, I'm not keen though on having some one-off site gather a bunch of personal information.
CS2011 wrote: and i am trying to reduce the development time in every possible way
There's quite a few open source examples of using Google/FB/etc for authentication, in a variety of languages.
Rolling your own authentication can be a PITA. Besides the obvious (encrypting the password) it requires:
Are you sending an email with a link to confirm registration?
How does the user change their password?
How does the user recover a lost password (more emails usually)
What about 2-factor authentication (typically a text message)
Which means setting up an email server (along with the associated risk of more open ports and the overhead of setting up yet another secure server), one-time tokens expirable tokens for registration, password change and password recovery, possibly connecting to an SMS provider for 2-factor authentication, and probably CSRF/XSRF/XSS protection.
[edit]Oh, and cookies or some other mechanism to implement "Remember Me"[/edit]
Latest Article - A Concise Overview of Threads
Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny
Artificial intelligence is the only remedy for natural stupidity. - CDP1802
|
|
|
|
|
No for the same reason as many above I would not use cross website authentication. I do not think you have to write your own either. Plenty of options:
Google: cloud user authentication
"If we don't change direction, we'll end up where we're going"
|
|
|
|
|
the app/website i am building will be free to use. As per now i am not aware of any service which is providing that free of cost. So my options are limited to use some already written module for user management and maintain the server/security etc or avoid it altogether by using Google/FB/MS etc. In case if you know of any service which provide that service for fee up to say 1000 users definitely i will be willing to give it a try.
|
|
|
|
|
I'd prefer to not use Google/FB/MS for logging into anything but as a developer I recognize the convenience of utilizing it for speed, ease, and so on.
Why do I prefer not to? A multitude of reasons. First... single password, multiple sites. With individual logins I can create a unique password for it. If your site gets compromised, only that site is compromised. Second, the big guys aren't perfect either. Google just admitted it knew about a security bug which gave developers access to private profile data and chose not to disclose it. Facebook just had a bug that allowed your account to be impersonated on linked services. Twitter had that bug where all logins and passwords were being written in plain text to the internal error logs. MS has had their own security problems in the past.
I tend to avoid sites and services that force me through one of those routes if there is a viable alternative. I also recognize that those views put me in the minority.
|
|
|
|
|
Sorry, absolutely not. But I'd be happy to create an account at the website (or better yet, use the website as a guest without having to sign in).
/ravi
|
|
|
|
|
I have a "totally legit" google ID that I use for logging onto websites that allow to be authenticated via one.
|
|
|
|
|
Company switched over to gmail some weeks ago, and I was used to having spam fully disabled. Gmail is a bit fiddly with it but you can make a filter which I assumed meant any spam would go to the inbox.
So when I noticed the spam count of 1 this morning. Click the tab and see a Microsoft Insider Program newsletter.
My first reaction is, "Oh okay, it's a newsletter that a bunch of others might have clicked spam to, and gmail with its black box just following what the masses it told it."
but "I stopped getting spam things. Odd, the filter is working. I have really bad spam in my inbox."
NO "is google hiding any potential Microsoft tools which could make me switch back to office?"
Let me actually read the stub alert for its reason.
"Ahhh, redirected from my old account and gmail unable to verify sender."
That is all good. No worries.
...
Test sending to the old email account to see if my filter works on those as well.
Email arrived into Inbox.
|
|
|
|
|
But these are still in production, to my surprise: Wilesco D16[^]
I had one when I was a kid, probably handed down from my uncle. I never bothered to oil the piston before running it, but it worked anyway. I wonder what became of it. It probably disappeared when we moved to Texas. Or it still is hidden in a storage box.
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
Got mine...somewhere...still. 
|
|
|
|
|
Why are they not charging their cell phones on these?
That's a steam powered generator. I'm ready to run my house off of a couple of those. 
|
|
|
|
|
Why don't you 3D print a generator[^]?
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
Those two together are perfect. Now all I need is fire and water and I can power my home and charge my phone.
I'm going off grid!
|
|
|
|
|
Even better: Wilesco T125 Steam Turbine Generator[^]
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
A rather costly toy.
| Ravings en masse^ |
|---|
| "The difference between genius and stupidity is that genius has its limits." - Albert Einstein | | "If you are searching for perfection in others, then you seek disappointment. If you are seek perfection in yourself, then you will find failure." - Balboos HaGadol Mar 2010 |
|
|
|
|
|
Then don't look here[^].
I have lived with several Zen masters - all of them were cats.
His last invention was an evil Lasagna. It didn't kill anyone, and it actually tasted pretty good.
|
|
|
|
|
Wondrous Machine[^]. Deserves to be played loudly.
(This one actually preceedes the steam engine by about 20 years; it dates back to 1692.)
|
|
|
|
|
Or an older version: Wondrous Machine Purcell - YouTube[^]
A paean to the pipe organ, for St. Cecelia's Day.
I wanted one of those steam engines as a kid (Sears catalog), but they were apparently too expensive at the time.
modified 10-Oct-18 12:22pm.
|
|
|
|
|
Considered purely as music, that is a beautiful version - and there are several other beautiful versions at YouTube. But nothing makes me associate to machines in any of those performances. In these beautifully sounding versions, the lute comes through strong and clear...
The L'Arpeggiata / Vincenzo Capezzuto version, especiall when played at a high sound level, is the only one I know of where I can hear those machine noises to which "the warbling lute, though used to conquest, must be forced to yield, with thee unable to dispute".
Another thing is that I love the voice of Vincezo Capezzuto, and the musical arrangements of L'Arpeggiata. For another Purcell song, try Twas within a furlong - (Henry Purcell) - L‘Arpeggiata Christina Pluhar - YouTube[^].
|
|
|
|
|
An easy peasy one after yesterday 
Maybe deals rot to guide us. (8)
We can’t stop here, this is bat country - Hunter S Thompson RIP
|
|
|
|
|
LEOTARDS?
DELATORS?
I'm so tempted to leave it there and let you go again tomorrow, but ... you did post on time.
LODESTAR
Sent from my Amstrad PC 1640
Never throw anything away, Griff
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
Wrong it was leotards 
We can’t stop here, this is bat country - Hunter S Thompson RIP
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
