Authentication in 2020

Vincent Dal Maso — Mon, 30 Mar 2020 09:53:21 +0000

Authentication in 2020

First of all, in light of the different leaks of user profiles and passwords happening all over the world, it seems like authentication in the web is broken. And nothing is seriously done to prevent user accounts from being hacked. Historically, it is not new to get hacked and it is connected to our authentication method.

Authentication before 2015

Since the avent of internet, users have always been required a username and password in order to get authenticated by a web application. With our lousy memory, we tend to use the same password several times or change only a letter to uppercase when needed by the password validation. In most cases, we use extremely simple passwords, and it result on our account being hacked. It is even easier now that the past leaks have created a huge database of logins available to anyone.
As a developer, passwords should be handle with uttermost care. Although, some careless developer still keep those passwords as plain text in their databases. Consequently providing easy data for future leaks.

Authentication after 2015

For the sake of security, around 2015 started a new trend in authentication, "Two Factor Authentication" or 2FA. This method of authentication is mainly based on a username and password in addition of a code sent one way or another to a user's owned device. It has been confirmed that 2FA could prevent 95% of attacks on a web application. Still, in 2020 it is not commonly used, Why ?
Their is several causes:

Users tend to get bothered by multi steps authentications.
Security is not a first priority for Management or developers, even if it can damage the company's reputation.
Including 2FA is time consuming.
Entrusting another company with its users database is tough.

Authentication in 2020

Nowadays "Multi Factor Authentication" or MFA is becoming a buzzword when we talk about authentication. But we are still years behind when it comes to securing user accounts. Nevertheless their is options to remedy to the situation.

Multi Factor Authentication

MFA is a standard today, used by most of the tech giants and it should be democratized. It can be added to your software by open source libraries or third party services. Although it can be sensitive to entrust another company to handle your user database, even so, they put their reputation on the line by providing this sort of service.

Passwordless Authentication

With the avent of MFA, a new trend is now emerging. Passwordless authentication. The goal is to replace the username/password step commonly used on the web, by a link sent to your e-mail address, only or combined with other authentication steps. This prevent the user from typing its password and thus remove the human issue from the equation.

Conclusion

It is a duty to secure our user accounts. If it is not for the company reputation, it should be for our self-esteem as a developer, architect or manager. Delivering a secure web application to our users should be a goal in 2020. So which decisions are you going to take to secure your users ?

MFA -> https://en.wikipedia.org/wiki/Multi-factor_authentication

Microsoft Passwordless white paper -> https://www.microsoft.com/en-us/security/business/identity/passwordless

Initially posted on my blog

Rust in web applications

Vincent Dal Maso — Fri, 07 Feb 2020 07:29:28 +0000

Hello everyone,

I have been thinking about using rust in web development for the past 2 months but in light of the recent events surrounding actix, I am wondering if is it worth it to commit a whole project to a single library.

Since the standard library is focus on low level programming and all the library available on cargo seems to rely on a huge amount of other external library. How do you assess the potential threat to the security or longevity of your project ?

For me, node modules or python libraries were already a pain to check against security and company policies. But in my perspective the problem is even worse for rust.

I’m a huge fan of the language, and follow very changes, but I keep coming back to go when it comes to write a simple service, without over head.

Forem: Vincent Dal Maso

Authentication in 2020

Authentication in 2020

Authentication before 2015

Authentication after 2015

Authentication in 2020

Multi Factor Authentication

Passwordless Authentication

Conclusion

Rust in web applications