Me: *Watching a movie*

Main Character: "Oh no, we have to hack the CIA to figure out how this machine works! Hacker girl, do the stuff"

Hacker Girl: "Consider it done!"

Hacker Girl: *Opens Linux bash*

Hacker Girl: *types 'mkdir Hack_CIA'

Hacker Girl: "They have two-factor authentication in place, this is going to be a hard one."

Hacker Girl: *Types 'cd Hack_CIA'*

Hacker Girl: "I'm in!"

Me: "..."

Friend: "Wow, so well done, so realistic!"

Me: *Dies*

Two factor authentication atrocities 😍😍

** The most hilarious authentication implementation I've ever seen **

They stored password in cleartext, but never mind, this is sadly quite common.
For some reasons credentials were also case insensitive (maybe to avoid silly tickets from CAPS LOCK lovers?).

Then I had a look to the query executed during the login:
SELECT * FROM users WHERE username LIKE ? AND password LIKE ?;

So I tried logging in with user "admin" and password "%"... and it worked!
I laughed all the day.

So my friend has two-step authentication for his smartphone.

Now he is not able to find his phone.

So, he tried to find his phone by logging into his google account via Android Device Manager.

Now, it is asking for the authentication pin which is in his phone.😂

He just got deadlocked.

Use biometric authentication

This is not really a rant, but...dude.

I was browsing github for a suitable library when i found a test repo of someone. A script inside and at the top he wrote his authentication token. I first thought it was a placeholder or an example or a test he used. No. I entered the token and could control his instance of the app. I sent him a message to disable this token.

I get that fingerprint authentication is very convenient but I'd never use it (not even for privacy reasons that much).

When someone guesses/gets your password you can just say "alright let's change my password"

Imagine that with fingerprints: "yeah sure let me change my fingers"

😆

"Do you have 2 factor auth for the database?"
a customer asked. I stared on the wall in front of me and suddenly fel and urge to punch and piss on something.
I took a deep breath while thinking to myself
*Oh boy, here we go. Another retard*
I put on my nice voice and asked:
"What you mean?"
The customer seems confused, as if my question did not make sense and he said:
"TWO FACTOR AUTHENTICATION! Dont you know what it is? To make the database more secure."

I was fucking right, this person reads to much shit. The fact that the email signature of that person said "Wordpress Developer" made me more angry.
I, still with the nice voice asked
"How would that work?"
"Two factor authentication when I am connecting to the database."
"So, do you want it by SMS then? You'll get alot of messages if it is going to send you one every time a query is made."
The following 7 seconds was dead silent until I heard the person hang up.

Mark.

Mark was a support guy who could have been replaced by a robot. Nearly every support request that came in, whether it made sense or not, had a reply saying:

"Thank you for your query, I will escalate with the development team"

...and then I would have a message saying:

"Hi Almond urgent issue case xxx - I think you need to PLEASE CHECK LOGS" (yes, with that capitalisation.)

I'd then look at the case, take 10 seconds to work out the customer had done something stupid when calling our API (often forgetting their authentication details, despite a clear message telling them as such) and tell Mark what the issue was, and how to find it for himself next time. I'd then usually get:

"Thank you but PLEASE CHECK LOGS to see if there is any more info we can provide to customer"

...there would be more back and forth, and then eventually something like the following would reach the customer...

"Very sorry the development team have a major issue they will fix very soon but in the meantime a workaround is (instructions for using authentication details)"

🤦‍♂️🤦‍♂️

Protecting credentials from eavesdropping using HTTP Basic Authorization header:

Client asked for Two Factor Authentication as a part of the webapp we're building and then were confused as to why they needed a second password to login

"we don't want to add an extra step into the login process, can you remove it please"

fml

Look, PHPVirtualbox, i love you and all and you've worked very well for me for ages.

But, when I see the authentication is successful and you receive an 'OK', YOU'RE NOT SUPPOSED TO THROW A FUCKING "USERNAME OR PASSWORD WRONG" ERROR.

YOU'RE SUPPOSED TO LET ME FUCKING THROUGH.

MOTHERFUCKER.

Tonight I want to try to setup an openvpn server with mysql based authentication because I'd love to somehow setup/become a vpn provider.

Of course there's a huge ass legal part but let's first make sure I know the technology of the top of my head!

Just ranting this out because I'm excited 😊

Wow... Captchas are getting better!

Especially painful being a cybersecurity engineer;

Did something wrong with an if-statement.

Caused authentication to break completely; anyone could login as any user.

Was fixed veeeeeeery quickly 😅 (yes, was already live)

Client: "Hey we want you to integrate your product with our system."
Me: "Oh, OK. Where's your API?"
Client: "Here! We even have an outdated .Net SDK, we use XML."
Me: "Ok.. how do we authenticate? What's your OAuth 2.0 endpoint?"
Client: "O auth what?"
Me: " You know, the current standard for REST API authentication and authorisation"
Client: " What's REST?"
*Hungs up*

Honest speaks😜

I can add two-factor authentication to GitHub, but my online banking password must have EXACTLY 5 characters...

After a few hours, I think I just got mysql based openvpn authentication working O_o

Fucking yay! Now let's implement a maximum amount of connections per user.

Yes, rants can be happy too.

Authentication feature was only checking the length of the auth header instead of the actual content. I abused this to make a request to our API from inside our system with a junk header, so we were basically hacking ourselves...

"So you need access to the test server?"
Me:"Yes"
"Please fill these 800000000 forms,sign here,get your blood sample,your ID ,your right kidney,letter of approval from your boss,...."

Fuuuuuuuck!!!! I just want to change only 3 lines of code!!!!!!

- Let's make the authentication system so the user can only login in one device at time, because this is more secure.
- You know that this will be a general-public application, right?
- Yeah!
- Sou you want to "punish" users with a logoff on the other device when he tries to login in a new one?
- Yeah!
- But before you said we will use Json Web Token to make the backend stateless.
- Yeah!
- And how will we check if the token is the last one generated?
- We will store the last generated token for this user on a table in our DB.
- So... you are basically describing the old authentication model, with session tokens stored on the backend and communicating them via cookies.
- Yeah, but the token will be sent on the Header, not on cookies
- Okay, so why will we use Json Web Token to do this in the first place?
- Because this is how they're doing now, and this will make the backend stateless.

A moment of silence, please.

One day with a lot of hours trying later:

Got an OpenVPN server running from scratch and can (still have to write the actual authentication code) accept or refuse clients through a php script ran from a bash script with a username and password.

Fuck yeah!

Dev checked in code (I suspect purposely not inviting me on the code review invite) saying he "fixed" the authentication bug in the web service.

Um no, like I told you last week, the authentication error is because the load balancer wasn't passing the user's authentication to IIS.

If I didn't overhear him telling a user "Still getting the error? I don't know, we might have to re-write that service", he might have gotten away with it.

Me: "Wait, that doesn't sound right. If I hit the server directly, authentication works. Its an issue with the load balancer, not the service"
Dev: "Admin said the load balancer is fine and it has to be the service."
Me: "I don't buy it. IIS is returning the authentication error, not the service."
Dev: "I added exception handling and nothing is being logged. Must be something in the service configuration."
Me: "No, IIS performs the authentication, not the service. I explained that last week, remember?"
Dev: "Oh yea. What changes do we need to make to the service?"
<my blood pressure starts to spike>
Me: "None. Give me a sec.."
<we have other apps on the same server farm that work just fine, so I re-configure the service pool settings to match theirs>
Me: "See, now going through the load balancer, the service works fine. For some reason, the admin had our service set up differently."
Dev: "OK, I'll let the users know the service is fixed."
Me: "Service was never broke and I'm not leaving it in its current state. In the morning I'll talk to the admin and see what he can do to fix."

I used PHPMailer to send emails to a client's website user. SMTP host is smtp.gmail.com.

web was hosted on Bluehost. I found out that mailer was not working. I enabled verbose output and to my surprise I found out that Bluehost was intercepting my mail and responding with

220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail

when i was explicitly using smtp.gmail.com. Not only they were intercepting but also They were trying my credentials against its own smtp server and then showing me that authentication failed.

When i contacted chat they asked me to tell last 4 characters of Bluehost account password to verify ownership.

Dude do they have passwords in plaintext.🤔

A month ago I had some medical tests, the next morning, the clinic's send a email with my results. Oh surprise, unbelievable security flaws. They sent me a link without any kind of authentication, token, or security. I looked at my results, and by entering consecutive and random numbers I was able to download a lot of results and folders of other patients. I wrote an email to the clinic informing them of this situation and their response was "Thank you". Today I have accessed the link and the error is still present. I am going to notify higher health authorities.

I gave resignation so am on my last weeks. The top priority is suddenly an authentication service that is completely unfamiliar, proprietary, requires me to RTFM, and requires contact with a slothful vendor about details for our specific instance. Can you do it on a 10 day deadline?

“Are you sure this wouldn’t be a better fit for someone that has implemented this authentication system before? Someone with existing relationships with contacts that manage the authentication service? Maybe I should be the one transferring my understanding of the other 60k lines of code that I singlehandedly wrote? I’m starting from zero here. Maybe it would be good for the guy who isn’t leaving to do this one so that he can retain the knowledge of the authentication system for next time you need to implement it?”

They just plug their ears now because they clearly don’t trust me due to my resignation state. Just do it. Wow.

The 5 whys

So.. we cant deploy

Why? > We had to take our deployment tool offline
Why? > Because random people from the internet started deployments
Why? > Because we had no authentication and so it was publicly available
Why? > Boss said auth was no priority (we told him every day)
Why? > ¯\_(ツ)_/¯

I really have this fucking love/hate relationship with application security.

For a lot of stuff that I write, user input has to be validated, authentication is required and so on and I do love looking into that, pentesting my own applications to death and thinking about the security architecture of the application itself.

But, sometimes, I just want to focus on the fucking features and then it annoys the living hell out of me that securing an application can take so much time and brain power.

Yay and grrrr, I guess.

When you want to unsubscribe from a newsletter and it requires you to login.... WHY?!

Unaware that this had been occurring for while, DBA manager walks into our cube area:

DBAMgr-Scott: "DBA-Kelly told me you still having problems connecting to the new staging servers?"
Dev-Carl: "Yea, still getting access denied. Same problem we've been having for a couple of weeks"
DBAMgr-Scott: "Damn it, I hate you. I got to have Kelly working with data warehouse project. I guess I've got to start working on fixing this problem."
Dev-Carl: "Ha ha..sorry. I've checked everything. Its definitely something on the sql server side."
DBAMgr-Scott: "I guess my day is shot. I've got to talk to the network admin, when I get back, lets put our heads together and figure this out."
<Scott leaves>
Me: "A permissions issue on staging? All my stuff is working fine and been working fine for a long while."
Dev-Carl: "Yea, there is nothing different about any of the other environments."
Me: "That doesn't sound right. What's the error?"
Dev-Carl: "Permissions"
Me: "No, the actual exception, never mind, I'll look it up in Splunk."
<in about 30 seconds, I find the actual exception, Win32Exception: Access is denied in OpenSqlFileStream, a little google-fu and .. >
Me: "Is the service using Windows authentication or SQL authentication?"
Dev-Carl: "SQL authentication."
Me: "Switch it to windows authentication"
<Dev-Carl changes authentication...service works like a charm>
Dev-Carl: "OMG, it worked! We've been working on this problem for almost two weeks and it only took you 30 seconds."
Me: "Now that it works, and the service had been working, what changed?"
Dev-Carl: "Oh..look at that, Dev-Jake changed the connection string two weeks ago. Weird. Thanks for your help."
<My brain is screaming "YOU NEVER THOUGHT TO LOOK FOR WHAT CHANGED!!!"
Me: "I'm happy I could help."

Why nobody uses public/private key authentication for ssh and disable password auth?

Am I the only one around here doing this?

So this customer wanted me to create an app using Flutter (user and admin), PHP for the backend, so I made one for him . He seems to complain he can't login to the admin account which he called me to registered for him right after the payment and weeks later.

With deeper investigation , I checked the log he drop the table where users authentication is stored and blame me about that. Which I fixed it lately by creating a table back.

Later I visit my account Shopee , he reviewed me as "THE WORST PROGRAMMER "

So I was like WHAT THE FUCK? YOU DROP THE TABLE WHICH LEAD YOU CANT LOGIN AS AN ADMIN AND BLAME FOR THAT?

Why did I miss my turn while driving ? I was dreaming about authentication strategies in micro services.

Question regarding implementing two factor authentication.

I want to implement 2FA for at least one service I'm writing but I'm wondering, next to email, what services/implementations could I use?

I know that email isn't the best when it comes to security but I also don't want to force (a-technical) users to install an app specifically for 2FA so keeping email as an option as well.

But except for email, any ideas? Anything related to Google/facebook (prism integrated services) are a no go anyways (this has, as mentioned before, nothing to do with my ego or giving myself 'a pat on the back')

As for costs, I don't mind a little bit of money but the service will be free at first and I'm not rich :)

Looking forward to the comments!

PM ordered me to not use encryption for customer authentication links because we want to be able so send same link if the user loose it. "we have to prioritize usability over security". At least I can tell future hackers it's not my fault..

Ok wtf? How is it that I can give myself admin access to almost any Apple computer just by turning it on, holding down two keys, and then removing one file called “.AppleSetupDone”, without any kind of authentication? And I get access to all of the data on the device too. Within two minutes of having physical access to the computer.

This is a company with millions of devices in use, why is this even possible? And the only way to prevent it is to have a firmware password, which, by the way, is not a default option...are you serious

Something strange just happened, activated Fail2ban on another server and instantly blocked me when I already had ssh session open >_>

Does macOS terminal keep on sending ssh authentication requests? Or is my OpenVPN that keeps on sending requests.

Why does this keep on happening to me T_T

Me : I should start building user authentication system.
inner self : there are enough free and secure ones out there, just go read the documentation.
Me : fuck I'm not reading 10000 pages of documentation written in alien language.
inner self : well then you better start building
Me : **writes code
Inner self : you better add the data validation and security while coding
Me : I just want it to work !
Me after a few days trying not to suicide : the site is hacked, the code is bugged, hello darkness my friend

Saw this security blunder a while ago. Went onto some site and it showed me this username/password dialog (probably an apache's htpasswd or nginx one). Went away but returned quickly because I noticed I could see all content. Then I thought 'why the fuck not try?' so I dragged the auth popup thingy to the side of the screen and et voila... I could interact with the page as if nothing was wrong while the authentication popup was hovering above the page on the right!

I sat there giggling dramatically for a while.

And also permission denied and Authentication error 😠

Worst coding mistake: forget to remove print statement that prints user authentication details.

>Get password vom dev.
>Try to connect to MongoDB.
>Had some changes in how to connect because of Kubernetes and stuff.
>Always get authentication error.
>copy password again
>stop and restart portforwarding
>wait almost 1,5h (was lunchtime) for DevOps guy
>sit next to him and ask for help
>he unhides the password and deletes two spaces...

fml

Multi-factor authentication does not mean I have a password to your site AND have to login with Google. Also, I logged in with Google, you should have my email address now.

Oh, a user with that address already exists? No shit, it's me.

Your fucking login flow is broken.

MFA authentication setups that don't support standard authenticator apps, like 1Password or Google Authenticator can burn.

Yes, Microsoft, I am looking at you.

Fuck you Amazon.
Fuck your two factor authentication.
Fuck your PINs over SMS that take 1 hour to arrive.
Fuck you.

NO FUCKING GOOD NIGHT FOR FLOYD.

THIS MULTI FACTOR AUTHENTICATION IS A FUCKING NIGHTMARE.

So my organisation uses some MFA app as an SSO to access any and everything. Fantastic. Absolutely wonderful. No VPN shit and one password to rule them all.

But, for some reason I accidentally deleted the app from my phone and as any normal human being would do, I also reinstalled the app.

Well, post reinstalling, the app does not detect the linked Org account.

I was cool, when I'll login, the system will throw a prompt to map the phone.

So I login to org URL from my machine and lo and behold, the URL says that MFA is already linked to the phone and I have to enter the Citrix type code to login.

But phone does not show the code because account is no longer linked and web does not have option to change/re-register the phone.

What the actual unholy fuck?????? Bloody retards. How am I suppose to get in now?

So after a Googling for a bit, a thread mentioned that this is most common issue faced by users with this MFA app. The only way to get this resolved is to contact your IT team.

Cool. Let's do that.

I opened the link to my IT portal and it asks me to login via SSO which is what I need help with in first place.

I can't login to Slack because fuckers ask SSO every time the app is exited. So no contact there.

Thankfully bastards allow Outlook so was able to drop a note to one of my team member, whom I connected recently and is very nice, asking her to help me sort this IT team.

If this is the most common use case then why the fuck not add a feature to help people overcome this shit?

And my IT team is absolute nuts. No other way allowed to reset the linking or connect them or any help links provided on login page.

Whoever was behind this design should be dipped in donkey shit and deep fried in pig urine.

I once found a MongoDB cluster open to the internet with no authentication with nearly a terabyte of data that backed a CRM service whose customers included Microsoft and Adobe to name a few.

Apple is now forcing 2 factor authentication for publishing apps on the App Store. Except not just regular 2 factor, 2 factor via AppleId. Which means you have to have the AppleID on 2 different Apple devices! You now have to have a Mac and another Apple device to ship an app and you still have to pay $100/yr for the license.

Hell I usually like Apple stuff but this has gone so fucking far off the rails.

2 factor authentication 😁

My security knowledge is so bad. But I don't know where should I start.😖
My coworkers know about this, so I don't get involved on related topics.🤤
Last time I asked same question, someone gave me link, and it all about DIY welding metal tubes into a security door.🤦‍♂️
Any better suggestion?

We have a portal which uses Windows Integrated auth that lists out all off our internal sites.

Navigating to any of these produces a URL like the one in the attached image.

Turns out all our internal application use a base64 encoded email address in the query string as the means of authentication.

So, anyone can authenticate themselves as another employee within the company by simply changing the query param value to said employees email address.

Fucking nuts.

One day, I spoke to my team which yubi or nitro key to get.

Senior (s) : but what do you need it for?
Me (m) : for encryption. And securing our password managers. Stuff, I guess.
S : encryption is not gonna be a thing. It hasn't and it won't.
M : *leaves*

I've been so baffled I couldn't cope with the situation.
A few weeks later I left the company. There were too many of such people and those products.

We're digital plumbers.

90% of this job is figuring out what thing to connect to what thing and then figuring out how to connect them.

Writing the code that goes in-between both ends of the pipe is easy if not trivial 90% of the time.

Meaningful change in this industry is centered around endpoints: contracts, deployments, etc. Nobody needs yet another way to organize and import their leftpad().

Fuck this
I get to work with API where you CAN authenticate with username/password and get a token

But you CAN'T get user info from token (auth response contains ONLY token)

So what I have to do:

1. Get token

2. Request ALL FUCKING USERS and load them into my DB

3. Search through local DB by username and, yeah, here I go

Now I need to have a cron job to update user DB 1/2 times per day

I can't think of ANY reason not to allow this

Once upon a time, in a proprietary e-commerce framework used by few hundred sites...

I just took over a project where the previous developer stored password in two separate fields.

password & password_visible

First was encrypted and used for authentication. Second was plaintext password and was shown in the admin panel.

Hope to meet this god someday, I'd sure ask why the hell did he use encrypted password for authentication anyway. 😂

This is what I get for not putting authentication on the contact form on my portfolio...

Microsoft Teams can burn.

Who the fuck thought it would be an excellent workflow, when you want to COLLABORATE IN TEAMS between users in different domains, that each sorry bastard needs to manually log in to a second Teams tenant and loose all the context from their main Teams tenant !?

On random occasions the fucking authentication token expires. I send messages to my team mate in another domain. Three days later I am pissed off because they don't answer. It turns out their authentication token has expired so when they are on their main tenant they don't get any notifications before they manually log in to our tenant as a guest. HOW FUCKING GREAT IS THAT AS A NOTIFICATION SYSTEM ??!

Would it be that fucking difficult to maintain a notification bar with all tenants and note with an exclamation mark or something REALLY FUCKING SIMPLE to hint about an expired token ? It's not like this is magic, Slack does it already.

FUCK !

Friend of mine created a blog from scratch... You could create a post, by just sending a POST request (no authentication required!)....
As an additional bonus: you could dump full unfiltered HTML in a post, which was then executed...

Please kill me

Someone ask to me as a security engineer.

Bro : what do you think about most secure way to authenticate, i read news using fingerprint no longer safe?
Me : yes they can clone your fingerprint if you take a photo with your fingerprint to camera.
Bro : so what is the other way to authenticate more secure and other people can't see in picture ?
Me : D*ck authentication is more secure now, other people can't see your d*ck pattern right?

Friend asked if I have ever built authentication using PHP and SQL...

Feel like sending links for them to research how instead of having me build it for them.

Teach a man to fish...?

Read a blog post at work yesterday from the company head of IT security. Line 1:
As part of our company policy we enforce the use of usernames and passwords, known as two factor authentication. However we also need to ensure.....

Stopped listening at this point as I hit Google to confirm the definition of two factor auth.

Nope I'm not loosing my mind, the blog post is insane....

Call it like you see it:

TF30063 : You have been fired quietly, or the Microsoft authentication system is down (again.)

Might be more of a self-rant.. We’re developing an application with token-based authentication.
It’s a big an complex authentication model and flow, which we wrapped up a month ago. All of us very proud of it.

All of a sudden none of it worked.
We debugged for days, there were no errors or anything to trace what was happening.

Today we realized that we set the expiration of the token to 20 years.
Aaaand the expiration time is later on converted to epoch.

Guess what happens when you try to use a value > 2 147 483 647 in C#? Stuff blows up, cuz that’s the limit of an int32.

So yeah, feels good having prepared for the Y2K38 bug already, even though we’ll be replaced by AI writing better software than my dumb ass by then.

(To be fair, it was hidden in Microsoft Owin, which could use some error handling and/or proper messages..)

Don't bother programming anything for us. We'll never use it. (I work at an IT help desk Technician at a school and this was from the IT director)

They now use 3 of my projects (one SSO authentication, another issue tracker, and the other inventory)

Am I allowed to use an API from the government that they do not have publicly documented or explicitly said anyone can use BUT don't have any authentication on it?

Just yesterday I found out that a multimillion euro corporation still uses Http (not https) rest end points, with the only basic authentication mechanism...
It only provides data to sales and inventory management, so I'm guessing it's not f*ing critical enough x.x

The Instagram API sucks a Lot.

Why the fuck I've to login with my account using OAuth2 to get posts of a PUBLIC account, it's so hard to make an authentication endpoint that doesn't require the user to enter his credentials in order to access PUBLIC content?

Fucking piece of shit

How does one hack a 2fa authentication?

This is the last part of the series
(3 of 3) Credentials everywhere; like literally.

I worked for a company that made an authentication system. In a way it was ahead of it's time as it was an attempt at single sign on before we had industry standards but it was not something that had not been done before.

This security system targeted 3rd party websites. Here is where it went wrong. There was a "save" implementation where users where redirected to the authentication system and back.

However for fear of being to hard to implement they made a second method that simply required the third party site to put up a login form on their site and push the input on to the endpoint of the authentication system. This method was provided with sample code and the only solution that was ever pushed.

So users where trained to leave their credentials wherever they saw the products logo; awesome candidates for phishing. Most of the sites didn't have TLS/SSL. And the system stored the password as pain text right next to the email and birth date making the incompetence complete.

The reason for plain text password was so people could recover there password. Like just call the company convincingly frustrated and you can get them to send you the password.

For fuck sake ... please make sure the logged in user is actually fucking authorized to see that orders info!! Very few things I hate more than being able to change the OrderID parameter in a URL and see somebody else’s order information.

"How do we share access to two-factor authentication."

What you mean is "how do we defeat the purpose of multi-factor authentication."

Seems someone from China was trying to hack my Apple ID. Due to 2-factor verification, was able to deny access and then I quickly changed password and forced sign-out of all accounts. Perhaps my password appeared in some data leak— it was not changed since 2 years.

Y’all make sure to enable 2-factor authentication and change passwords from time to time.

Someone just guessed my 20+ character one time password on Microsoft 🤔 2 factor authentication and Geo IP checking are definitely good features.

Well, time to change all my passwords.

Slack is cool and all... But do we really have to have an "account per team" ? Damn I cringed so hard when I was setting up two-factor authentication and realized it was this way... Wtf...

I sent my app to one of my lecturers(female). She opened it and it said "Login with Facebook". I had integrated FB login just like other apps for authentication. She thought that I was playing some trick on her to hack her facebook account and refused to continue...
Where to run, where to hide... 😂
After all, the login dialog was of facebook's itself and nothing else.

@dfox could we get double authentication for devrant?

Sign in with Apple...

* Nobody tells you that a app group can consist of a maximum of 6 apps.
* Nobody tells you that suddenly a key id is needed for constructing the signing key for signing the client_secret when other keys are added in the dev portal.
* Apple gives you email and name only (and i mean only) the first time a customer uses Sign In With Apple.
* You have no chance to reset your user during development in a way to try a fresh auth. So either create separate app ids or separate apple ids.

Sounds like fun, right?

Fuck Apple Two-Factor Authentication.

I am a developer with multiple accounts and this two-factor authentication is a fucking joke! I spoke to this idiot on the line who told me that I had to create an administrator on my computer to login to a developer account of mine. I hung up the phone and told her to "Fuck Off"

It's a fucking waste of time. Apple has not had an innovation since Steve Jobs died; each upgrade does nothing new compared with the last one. What's new things are there between 10.14 and 10.8??? Nothing. Except it's a lot fucking slower.

Windows file system is a slow piece of shit.

The update regime on most applications for Windows desktop is an unmanageable piece of shit.

Windows Store is a broken piece of shit.

The login process on a Windows computer is a tedious piece of shit.

The Windows Hello authentication is a half-baked piece of shit.

Microsoft MFA is a hostile piece of shit.

Windows Update is a destructive piece of shit.

Windows Defender is a resource-hogging piece of shit.

Windows system fonts are ugly as a piece of shit.

I am turning 16 in 3 months and I want to start freelancing then. I want to earn money and get some experience .

I will still go to school until I have my a levels so I can go to university later.

Do you have any advice for an absolute freelancing beginner? I will probably make websites with HTML and CSS (of course, what the hell else) and react. Nodejs and mongodb for the Backend.

What should I do in these 3 months to prepare myself?

I want to build a portfolio website and learn more about node, especially how to do safe authentication in these 3 months, anything else? Also which websites would you recommend me?

Client asked us to modify site made in some obscure CMS. Authentication on AJAX request is done by sending email and password as plaintext in header and then it would do md5 on server side

If your website has a login wall, my visceral reaction is to close the tab. After that, my rational reaction is to close the closed tab. Because fuck you.

Not only did my boss insist on setting up roles and permissions for our app how he designed them, even after I spent 4 or 5 hours trying to convince him to let me do it differently, but he has now fucked our entire system.

Under this model of roles and permissions you cannot enforce them on the backend by any means, and now we have a service dealing with users including resetting passwords and changing details that does not use authentication. That's right, aurhe tocation and not even talking about authorization now. Good job.

I honestly wish companies like this would get hacked and fucked over as soon as they did it wrong because I can't believe how retarded some people are.

I started programming when I was 14, because I was deeply enrooted in MMORPG hacking communities. It gave me an escape from real life, and I felt empowered by the skill to create something from nothing. My first language was Lazarus FPC, followed by VB.NET, C#, C++ ( managed and unmanaged non CLR ). As time went on, I found more ways to turn my "hacks" into software, and finally I began selling subscriptions which required me writing an authentication system.

After weeks of research, I began writing my own REST API in PHP using MySQL as my database. At this point I had an IPB forum up and running for a year, but with my newly acquired knowledge I was able to couple my API with my forum software. To properly distribute my API i had to learn NGINX to route my API to a subdomain.

Soon after I began writing my own portal for my authentication system, at which point I had become entirely enveloped in Web Development. I was 17 when I dropped my forum, I'm now 21 and freelancing web app consulting, day job as a QA automation developer.

Currently working on my first real REST api and I've arrived at the authentication part.

I'm not sure how to do this one, the client will have to login using username/password but then, what's the most conventional way of authentication logged in users through a REST api? (no oauth (yet))

This should be usable for anything like ajax requests to calls from the backend to curl requests.

Looking forward to ideas!

Changing authentication mechanism in SharePoint from windows identity to ADFS identity is stupidly complicated, especially for existing large farms with custom code.

On the plus side - just convinced the director this is stupid - saved myself, himself, and 1000 users a ton of misery.

Three days after I purchased iPhone XS, I had to install a new modem at home. The phone wouldn’t connect to the wifi network in the higher frequency band. The guy who came to install the modem dished out the theory that the phone must be too damn old to support it. That burn!

PS: it connected almost a couple of seconds later that. As if it was some kind of extra layer of authentication. Well played Apple.

Fucking mongodb I swear to god what is your problem, why do you close all connections after successful authentication you piece of concentrated crapjuice and why is the best information you can give me a pissing "Connection ended" message your demonic unholiness?

Stick a cactus up your rear, pot included

I find it funny that as soon as I disable password authentication on my server and enable key auth then all of the bots spamming my server with incorrect login requests instantly stop when they realise that they aren’t getting through any time soon. Also don’t ask why I don’t have Fail2Ban and a firewall set up.

They used strcmp (PHP) on the main server as only form of authentication...

Good morning to everyone, except that one Twitter dev who one day woke up and was like "YOU KNOW WHAT, MY APPLICATION WILL FEATURE BOTH OAUTH1 AND OAUTH2 ENDPOINTS, BUT SOME FEATURES WILL BE EXCLUSIVE TO EITHER OF THE TWO -NOT NECESSARILY THE MOST RECENT, JUST A RANDOM ONE-, AND ALSO THE OFFICIAL TWITTER LIBRARY WON'T COVER ALL THE ENDPOINTS SO PEOPLE WILL HAVE TO RESORT TO RAW HTTP REQUESTS INSTEAD OF USING MY SDK AND ALSO I'MMA MAKE DEVELOPERS FILL 2 VERY DETAILED FORMS, REQUIRING PERSONAL DATA AND ACTUAL REAL PHONE CALLS, JUST TO START DEVELOPMENT WITH 7 DIFFERENT AUTHENTICATION TOKENS, BECAUSE SOME REQUESTS WILL REQUIRE A DIFFERENT AUTHENTICATION METHOD THAN THE OTHER REQUESTS DESPITE ALL OF THEM PERTAINING TO THE SAME FUCKING ENTITY"

I'm in the 7th circle of hell. Building out an authentication system using a 3rd party vendor into our company's application.
Developing in PHP, running inside a docker container, using a Windows PC. Absolutely everything has gone wrong that could go wrong but PHPCS whining about a missing space between the "!" and variable name was the last straw.

I made Skype Bot which queries the data using wsdl authentication on our ticketing tool and send the data whoever has requested in skype itself(without logging or touching the ticketing tool).

Manager: Is that even possible?

Me: (In excitement) Everything is possible if you have the will.

Now, He wants me to work on his pet project. I dont know how to react!

Admin home page secured well, but every CRUD page available without admin authentication on prod environment... for at least 3 weeks

Scrape the Twitter frontend API without any authentication and restriction.

Oh ffs, just fucking inject a chip into my finger already for authentication purposes, you can track my every fucking move if you so wish. When a web page like twitch uses 2FA it boggles my mind because its a page where you're watching some fucking videos.

"hey there, so out of the blue, we send you a code to your email, we won't tell you which so good luck. Also, you cannot copy paste this code because we did that fucking thing where each character has its own textbox"

Of course, this is only because we are dumb enough to reuse shitty passwords. THIS IS WHY WE CAN'T HAVE NICE THINGS.

So I had been developing a real estate website and developing a MLS feed parser. I had only 1 year experience at that time and parsing a XML feed was already complex enough. On top of it, the client wanted to automate feed download from the MLS provider through HTTP authentication. Managed to do it. Everything worked for 15 days and on 16th day the property location markers stopped appearing on Google maps. Turned out that address to lat-long reverse geocoding was failing because API limit exhausted. My bad, I coded it on view instead of caching the lat-long in database. Fixed it in a day and viola!

Mail from Microsoft: sign in to see payment details.
User clicks on the link (once).

Microsoft:

Sign in to continue to Microsoft

Something went wrong and we can't sign you in right now. Please try again later.

The Microsoft account login server has detected too many repeated authentication attempts. Please wait a moment and try again.

Hey fastlane!

Great tool and all, but your documentation is at 🤡 levels, I need to read 20+ pages to get a full overview and understanding. So far I've had to read a dozen plus blogs and stackoverflow posts to find hidden flows (authentication first to do this, etc. etc. etc.)

Don't market your tool as "reducing complexity & saving time" and showing one-liners in the docs when in reality there are lots of hidden steps and NOT one-liners!!!!!!

This is why everyone complains it takes 1-2 days to just get a freaking pipeline working!!!!🤡

I've just bought 3 months sky ticket...
THEY ONLY ALLOW A 4-DIGIT NUMBERS ONLY "PASSWORD"?!?!

IN WHAT YEAR DO THEY LIVE???

AND THEY EVEN SEND IT TO YOU VIA EMAIL ALONGSIDE YOU USERNAME!

I guess their old windows server which handles their authentication would be overcharged when it'd handle real passwords.

My biggest challenge has been moving away from an unmaintainable Java/Tomcat/Spring Security application server to a Node.js/Express application server. That handles single sign on and two factor authentication. In 2 weeks.

I'm a front end dev. I'm sure it's fine 😓

-Rant-
How do you (not) secure your Rest based web service?
1. Chain it to shady organic authentication system built by a hoard of monkeys high on Tequila.
2. have secret keys that get copy pasted into config flat files, and index them on your code search engine.
3. make the onboarding extremely platform specific that you need 500 environment variables, 50 scripts, 5 fancy device presses and a tap dance to make a GET call to the service.
4. fish through 500 rotating log files that the authentication system generates for each API call made.
5. Leave traces all over the host so if you have to start over, you should sudo rm -rf / and set fire to your computer.

Attention guys and gals! If you are using grafana in your home setup, update it asap to 4.6.4 or 5.2.3. versions before those two are affected by an authentication bypass vulnerability. CVE 2018-15727
In the meanwhile, my nginx config is blocking everything but the LAN ips :)

Security is a joke. And people don't seem to get it. Especially Data mungers.

I've spent about half an hour trying to work out how to securely connect to power BI using PowerShell in a renewable manner for unattended access later on.

Every single example I've found seems to involve you storing $user and $password variables inside your script. If I'm lucky, they're going to pass them through ConvertTo-SecureString. And nobody talks about securely storing AD auth tokens, or using the Windows Credential Manager.

I know it's possible, but it's going to take me ages to work out how from all sorts of disparate sources...

authentication and authorisation can go fuck itself
why are there so little decent documentation on how to build an IDP
or implement OAuth2.0
dammit
maybe it’s just ASP.NET core and blazor
but fuck this

Imagine implementing PHP scripts which execute shell commands defined in URL GET query params on your customer's dedicated server without any basic authentication or similar. The only security is by barely obfuscating it's URL.
I think I've seen it all now...

Why doesn't Twitter have a public API without authentication for simple stuff, such as reading tweets. One can do that without logging in on the website, why shouldn't code be able to do it.

It is time for my own dumbass's favorite pastime: not letting go on retro tech.

I am gonna build a small and complete RESTful web API with Vbscript and Classic ASP with errrthing thrown in this mfker including JWT authentication and i am gonna see how the idea of an ORM goes. I know that COM interop was a thing, dunno if it still is.

I am fucking bored. The graduate degree is killing me and I need a distraction.

Thinking about being a purist and keeping the COM libraries to be made with VB.NET :P

Fuck yeah for being a masochistic retard.

I legit love vb net tho

/rant
When you spend longer trying to work out why your background <div> refuses to cover the entire page, than you spent coding an entire user-authentication system in TypeScript for Angular 2.

Fuck all authentication everywhere all the time. Fuck your passwords. Fuck your fingerprints. Fuck your rolling key fob. Fuck your aws secrets. Fuck your docker secrets. Fuck your oauth. Fuck your /etc/passwd. Fuck your groups. Fuck chmod and fuck chown and definitely fuck Kerberos. Fuck Saml. Fuck duo mobile. Fuck rotating pins. Fuck axiad. Fuck selinux. Fuck your fill out this form to get role based access. Fuck it doesn’t work because you can’t log in. Fuck it.

Enforcing two-factor authentication is bullshit!

Rebooted a server..
1 hour passed and ping is still failing..
idrac authentication is failing

Company sends email notifying us we'd need to register for two factor authentication because it would be mandatory for all access to email within a week. However, it had to get manager approval and had a side effect of giving us access to work from home (which my manager hates). So, we send the request to him, explain the situation, he denies it and says "that can't be right! Let's do this: if you do in fact lose access to email, then I'll approve it". Well, we did lose it, and just spent two days without any access to email and it was a huge pain to get the registration process done because one of its steps involved getting a validation code from the email.

My bank created a "new and improved" banking app asking me to take a selfie after first sending them a picture of my id.
I am already a customer of the bank, they have a copy of my id, why do they also want a selfie?
Also with the old banking app I could just call them from my phone number (which they also have) and they confirmed it was me over the phone by asking 2 questions and then provided me with a code to just enable the app on my personal phone.

I'm breaking out our authentication logic to a separate OIDC server. It's technically pretty straightforward, but just the thought of moving all those users and making sure that the communication between the system and the auth server works properly makes me shiver...

A remake of a website named Death Roulette where Twitch viewers could bet against each other on how the streamer would die in different roguelike games like Spelunky or Crypt of The Necrodancer.

The original hadn't been updated in a long time and the API it used for Twitch authentication was deprecated and removed so I built my own version in about 2 months, just in time for streamer "Vargskelethor" Joel to play Spelunky 2 with his chat when the game came out.

Needed a bit of help from another chat member to get it running at scale but all in all that was my first full-stack project.

I have been trying to wrap my head around authentication in hapi for the last 6 hours...
Fuck this shit... when did simple,
I HAS A USERNAME
I HAS A PASSWORD
CAN HAS SESSION?
become:
- you magically get a token from somewhere
- you magically verify that token
- you respond with { credentials } //magic
- by some fucking black magic the server probably creates a session without you knowing about it...
- you freak out and write your own authentication scheme only to find out that you cannot read payload of POST requests in the authenticate method
- you get angrier and depressed and write a rant

(to be clear: there is @hapi/basic but I don't think sending a GET request with the URL looking like username:password@domain.tld is very safe...)

I'm sad that StackOverflow is removing OpenID support. I've run my own OpenID server for years, and I've slowly watched support get removed from all the sites I previously used it to login to.

Goodbye open, distributed, authentication standards.

Just got handed a dozen servers. Documentation shows a (Linux) database cluster is using ldap authentication. I try logging in with my creds. No joy. I look up the root password and log in.

Not only is it not configured to use ldap, it's also not clustered.

I need more coffee.

Started a new job, then I found out that the salary of the person in charge of me has lower/same as I have.

How did I know? I looked at the API without authentication of all the list of employees.

Luckily, I didn't sign the contract yet

Three-factor authentication:
1. Setup an Amazon.com account.
2. Setup an Amazon Web Services account under the same e-mail address
3. Setup two-factor authentication for both systems.
4. Login to Amazon Web Services in a new browser session, and you'll be required to provide BOTH security tokens at login (Amazon.com first, then AWS second.)

Just posted a rant that BitBucket gave me a big Internal Server Error

Then I realized one of my extensions was overriding the authentication token (as I configured it to do that for a dashboard) and that was why BitBucket was inaccessible

Why do I keep doing this to myself

I had joined a new company and got access to their codebase. They were updating password on MD5 hash of user name and their email in get request. No password validation, no token based authentication, nothing.

Eg
...com/change_password/email=(plainemail)&name= MD5(name)

That's it, you get change user password.

FUCK YOU GITHUB AND YOUR MASTER SLAVE BLEEDING FUCKING HEART SPINELESS FUCKING HYPERSENSTIVE BULLSHIT TO BEGIN WITH !!! NOW FUCK YOU FOR REMOVING SHELL AUTHENTICATION AND GIVING ME A GODDAMN OTHER THING TO ANNOY ME !

Wanna know about hacks? I'll tell you. There is a peace of software called SugarCRM. It has OAuth2 provider implementation. I was assigned to write OAuth2 consumer for it.
It turned out they just failed to make it right.
The list of hacks:
* Hack on standard Authentication header. They use custom.
* Hack on "scope". They send null which is standard violation. So it is replaced to empty string before response processing starts.
* This is my favorite. Refresh token simply doesn't work. So we need to store user's credentials in memory to be able to reauthenticate user transparently.

Here some more information to despise Apple.

In the past few weeks I keep having a problem making the iMac connect to whatever website/host, so I had to rerun whatever I had to do: fetching from github, push to github, connecting to a LAN server, pinging to know to IP, accessing a webpage and so on.
Luckily enough, browsers tend to request again if an error occurs.

At my job, I upload app files to servers, like GooglePlay and AppStoreConnect.

For those who don't know, Google makes you upload the app through the browser (among other ways) while Apple requires you to upload your app either through XCode. No other possible ways.

Whenever XCode requires an update, the authentication is required, but the authentication server cannot be reached for at least 5-6 tries.
Then I have to upload the app and just to be ready to hit the "upload button" it takes like 3-4 minutes, which might be completely useless if a network error occurs.

How hard is it to make your fucking app-loader to try again at least a few times?

I'm so done with auth
it's more than a nightmare
it's a disgrace
why can't someone just be like "you know how auth and identity is hard? why don't we make it easy?"
I would pay so much for that

I feel like a fraud ...
So I recently joined a mobile dev company as an intern
I submitted the application
Got to coding interview passed the coding interview because thank god it was one of the sums i solved on geeks4geeks
Then came then interview did as best i could
Got the acceptance mail in next 10 mins
First day was chill it's work from home thing
Second day they gave me an app a previous intern had already build its layout and authentication code
But it wasn't working so I reported it so they told me to debug it so I found where the problem was occurring
Now I know the problem but i have no idea how to fix it
They gave me assignment to fix the authentication basically it's taking info creating a json and request an API call
But I feel i cant remember the concepts
I can't remember basic meaning of words the other day i forgot what SSID are
I just I don't know shit
And i feel like I'm going to get kicked soon
I don't understand what the previous guy wrote and i don't know how to fix it
Previously i have built my own apps but not like a real world project like this which works in regards to network management basically an wifi portal kind of Authorization application

Basic REST server authentication: pass a valid username in the URL of your request and you can publish trade and market data that's used by other systems.

I think they're moving to oAuth now but... These developers are slow and only do things when a gun (Sr. Management) is held to their heads.

Dude at work floats the idea of creating separate Github accounts for personal and work for security. My response:

While we're discussing options, we should also consider maintaining a list of users as a CSV^H^H^H MS Excel file, and install an authentication server that runs off the laptop of an "IT Administrator". That way it'll be super secure because hackers cannot access any system outside of working hours, as well as the days that said admin is off from work.

WHY THE FUCK DO YOU FUCKING RETARDS USE TWO DIFFERENT AUTHENTICATION METHODS FOR THE PAYMENT AND THE CHECKOUT API AND DON'T EVEN DOCUMENT THIS SHIT PROPERLY!! 🖕

A project that is used across our company with multiple clients. It's huge, over 2million lines of code and 116 separate projects. Not a single piece of documentation. Took me three weeks to track down where the authentication occurred with visual debugging and mapping tools.

Fucking hell the AWS IAM documentation is confusing as fuck. Trying to set up a fucking role is harder than cutting a rock with a fucking spoon.

And who the fuck thought it would be a good idea to allow a CLI user to run any command he's allowed to without any form of authentication??
Oh, set up MFA for the CLI you say? Good fucking luck with that, if you ever manage to figure out how to set that shit up!
Fuck this shit!

Yeah, fuck all the authentication/authorization framework I build, just access manage resources directly and leak stuff, assign it to wrong accounts and don't even check if they should be able to with that eye shore you call code

OpenSSH has announced plans to drop support for it's SHA-1 authentication method.

According to the report of ZDNet : The OpenSSH team currently considered SHA-1 hashing algorithm insecure (broken in real-world attack in February 2017 when Google cryptographers disclosed SHAttered attack which could make two different files appear as they had the same SHA-1 file signature). The OpenSSH project will be disabling the 'ssh-rsa' (which uses SHA-1) mode by default in a future release, they also plan to enable the 'UpdateHostKeys' feature by default which allow servers to automatically migrate from the old 'ssh-rsa' mode to better authentication algorithms.

It's my first rant. So please ++1 me.

Now my rant:

In this semester I had a subject about system architecture. In this class, we must learn Java script, C# (and ASP.NET framework ), PHP (and Zend Framework 2), but in the classes is taught only UML and patterns. In the moodle of the subject we don't have any information about any of the languages and if we ask the teachers they don't know anything.
And we need in 4 weeks do a work with a widget in javascript, 2 Asp.net mvc, 1 asp.net web api. All with authentication.

So we are all fucked

Why has authentication of web services to be so fucking complicated?
PAM, OpenID, LDAP, SSO...
Every fucking service supports something different and I have a hard time finding a decent tutorial on LDAP and the likes.

I'm working with a consultant group at my company to implement a new authentication strategy for our entire platform.

The senior dev lead from the consultant group has 25+ years consulting and claims to have written a web browser for the blind and all sorts of in-depth accessibility things.

Stakeholders tell us "Don't forget about accessibility compliance on this project"

Senior dev lead with all this claimed accessibility experience asks me, "What does accessibility mean?"

Frikkin samsung. Who the hell decided to mandate 2 Factor authentication for a health app which needs phone and contacts permission.!? Your only job was to show how many steps i walked today.. The people who decide this and the people who decide that randomly installing garbage apps without my permission everytime i update, inspite of giving me horrible hardware for a costlier rate than xiaomi.. should rot in hell forever.

How the fuck does php type juggleling evaluate an variable as an integer on my system and passing all tests.
Then on the server as string, failing a typesafe comparison for authentication.

Why the fuck is debit cards that don't need a PIN for transactions even a thing? What is so difficult to understand or implement in a two factor authentication? Like do these companies have meetings where some fucktard proposes removing a crucial security feature and the others just nod approval?

I can’t take the stupid security theatre anymore. I give up.

Multifactor authentication every 5 minutes. I hate it.

I don’t have a solution and neither does anyone else that doesn’t involve rewriting all apps from scratch.

I am trying to "invent" secure client-side authentication where all data are stored in browser encrypted and only accessible with the correct password. My question is, what is your opinion about my idea. If you think it is not secure or there is possible backdoor, let me know.

// INPUT:
- test string (hidden, random, random length)
- password
- password again
// THEN:
- hash test string with sha-512
- encrypt test string with password
- save hash of test string
// AUTH:
- decrypt test string
- hash decrypted string with sha-512
- compare hashes
- create password hash sha-512 (and delete password from memory, so you cannot get it somehow - possible hole here because hash is reversible with brute force)

// DATA PROCESSING
- encrypt/decrypt with password hash as secret (AES-256)

Thanks!

EDIT: Maybe some salt for test string would be nice

A couple of weeks ago my work email got hacked, I found out because he/she was sending phishing mails to yahoo emailaddresses, but they couldn't be delivered because they were marked as phishing.

I've immediately changed my password and turned on two-factor authentication, shared my story with my boss and now we use two-factor authentication for every service where it is possible.

So here I work with this colleague that , at first , had a reasonable résumé. Whatever.

Time goed by and he is just doing tickets, clicking left and right, the usual grind of a shitty monitoring system which I am working intensely on deprecating that shit. Anyhoo

The last few days it became apparent that his resume was basically a hot air cake and he knows basically nothing intrinsically.
As I have stated before in previous rants, "everyone was a noob once"... But this guy...

He wants to do "something with Ansible"... "Ok what do you want to do?" , I asked (and I regret to have asked).
He basically wants to write new files on targets. Easy enough, I show him how he could do it with playbooks, inventory and role just for demonstrating the entire chain.

This guy chanes everything up, thereby breaking host group assignment, he launchea it on ALL machines...

Luckily it's a harmless file, so dodged a bullet there.

But the real wtf ia that he did it with the root account for our systems, without understanding the difference between "authentication" and "authorization"...

I am now explaining him what the difference is and how he can be able to check it. I give him the commands literally! ( sudo -l -U <user>)

Manages to fucking open up each sudoer file in vim , mistype or whatever he did in an attempt to leave vim... Breaks sudo...

Now he tries to spin it in such a way that I have steered him to break things.

"Dude you just fucking failed a copy/paste and you did absolutely fuckall without understanding what you are doing, then splurge out accusations because you did it wrong!"

FML

I setup a Firebase project, and then remove the authentication completely, so I can send API call freely.

After 2 weeks I am still alive...

That's amazing!

Wouldn't call it a feature. More like worst practice. Data manager (and my boss at the time) kept using our website as a way to host large files 3rd party vendors/partners could download instead of using one of the many secure transfer methods out there to send them data. This was sometimes extremely sensitive data. No authentication or security that I could find. I went ballistic on him after seeing that.

Having just endured 30 excruciating minutes of utter braindead idiocy that is trying to setup and configure WPA2-Enterprise on a Windows 10 machine, I wanna go and fucking kill myself.

How can it be so bad after so many years this protocol has been out?! Not only can the authentication options be changed only in the who knows how many years old control panel settings and not the modern settings app, but once you finish setting up the network, you can no longer modify some of the key attributes like which CA certificates to validate the radius server against!

What. The. Fuck. Microsoft.

I swear, I don't usually get my jimmies rustled at work, but this... This just bloody infuriated me!

So the contract for this big project with a client has some interesting content in it. I'm not sure if I can sign this in good faith.

Because I seem to be lacking guard dogs and a receptionist at my home office. Maybe I could build a force field for them.

And I'm not really looking forward towards having all my friends sign a document every time they visist.

5 PHYSICAL SECURITY
5.1 Adequate physical security perimeters (e.g. fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks and security patrols) shall be implemented to safeguard Information and information systems.

5.2 Supplier shall have a documented visitor policy and all visitors must be identified, registered, logged, and accompanied by an employee from Supplier.

Service I was needed to integrate to our system had such poor documentation and a separate pricing tier to access their APIs...

... Not having it. Used Guzzle to perform both the authentication and their search page, then made wrote a function to web scrape the result.

Job done. 😎 And yes, I have no shame to say I love PHP.

Another day, another tragedy...
1,5 half year later 2 devs were able to deliver :
- custom authentication. Basically they did a very simple client credentials grant.
- a custom wrapper to manage windows services
- a custom job scheduling system
- a custom logging library to log everything to windows event viewer!!!!!!
- all csv reports are created using string interpolation WriteLine("'{varA}','{varB}'") like this...

There are a lot of defects in those functionalities and they delivered almost 0 business features.

That moment you setup 17 domains on sparkpost as a email delivery system

make your account secure with 2 factor authentication like a good infoSec enthusiast

Go on with your life

Having a Phone crash but nothing to worry because you made them backupz

Restore backupz

once again go on with your happy life.

Having to setup a different bounce action on sparkpost

logging in to sparkpost to make the adjustments

opening google authenticator

realising the backup you restored was before you added the sparkpost entry

mailing sparkpost asking to deactivate 2factor authentication

Having them tell me that they have no access to Google authenticator so they can't help me and all they can do for me is delete my account if i answer their 7569357 questions that i entered a year ago ..

--
You have access to your database yes ? You can delete my account but you can't adjust a fcking Boolean column from true to false? #@?#&!

Why even offer a feature where you have apparently no control over. Stuff like this happens all the time and almost no one saves that fcking authenticator secret.

Make people use authenticators to keep the hackers out, forces them out instead.

Best debug ever?

Some years ago we had to do a web project as group. It was a cinema like website with backend and front-end.

So in the end we arrived at the presentation and while scrolling the code I found commented out some authentication controls 😅😆 (probably for debug reason lol)
Whatever, meanwhile, while I was talking with the professor two of my mates were whispering... Turns out they found what he mail service wasn't working. And what's best than fix it, push it to the Heroku server and restart all? XD
The professor noticed some little lag in a button and asked "what's happening?"
"oh, nothing we just restarted the server "

!rant

Many out there say you should use 2 factor authentication with everything, but personally i feel lile that would just turn your phone into a sigle point of failure.
Phisical security is my primary worry, because loosing your phone or having it stolen yould pretty much lock you out of all your accounts.
Another thing is i don't know as much about android security, and i wouldn't be confortable managing it.

I have 2FA active for some key services, but imho a strong password is usually enough. I think its far more more importat for your overall security to avoid passwords re-use.

What do you think? Do you have 2FA on all the time?

$ Login: phoomparin
*types in password*
Incorrect Password.
*rushes to type user and passwd again*
Password shows in cleartext...

Walking home from work gracefully,
minding my own business.

Swinging my umbrella gracefully,
With a slight crack of a grin on my face.

THEN THIS DUDE TRIES TO TAKE MY PHONE OUT OF MY POCKET! Non-gracefully!

Fuck poetic Justice, he ruined my happy thoughts,
I was planning an authentication decorator for a project am in love with
And the code was beautiful.

The phone fell on a wet footpath in the struggle,
Now my umbrella has mud on it!

So pissed!

Back again to the horrow show.
We start with the integration. It’s a new project, let’s see how it works. First step: authentication. From the documentation it claims to be an oAuth2. Wait..why just 2 steps to authenticate?! Nevermind, we’ll contact them later. Let’s go on for now.
They need a timestamp with microseconds precision. Here you are!
Nope. Come on! Take the damned timestamp! Nope. Let’s take a look at theirs. If it’s with milliseconds precision, WHY 7 digits after comma?!!!! We decided to contact them. And then.........their answer: we don’t know of any exact number of digits to represent milliseconds.

I see...so it’s arbitrary!!! What are you going to tell us next? One hour can be 3.14159265 minutes then?!!

Tips for architecture for authentication in microservice driven application.

All ms contain the code to authenticate? (Breaks single responsibly principle)

Edge level authorization?(gateway)
Service level?

How do you guys handle authentication and administration pages in your applications?

Can you write me a sync plugin for this API. Wait the 'authentication' is with a 'key' in a plaintext unsecure GET request with no throttling? #omg

My bank just switched from RSA SecurID to SMS-based 2-factor authentication, claiming it offers "equal security".
Is it not common knowledge that SMS 2FA is a security joke?? What the fuck guys?!?

Is 2 factor authentication really that secure, or is it just a ruse by sites to get to your phone???

Fav. thing I've worked on recently?

Blazor and creating our framework around authentication/authorization.

Got the Auth0 authentication flow working after 2 days. Time to celebrate!!

This is how my login and authentication works

Check for cookie on request

if cookie doesnot exist, send login page ( login )
1) check for credentials
2) if valid, set username's JWT as cookie
3) reload page
4) proceed for authentication

If cookie exist, decode JWT ( authentication )
1) check username
2) if username exist on database, send user panel

Anything wrong with this ?? What is the better way to do this

Why can't I wrap my head around laravel enough to build an authentication system I've built before 😖😡😠

External Login Service and my app would be an OAuth2 client receiving an id token...and no there isn't a third party integration for this login service

Third party asks to remove access_token from the API URL.

BTW, they are a unicorn here in India.

Do you think Auth0 is a good solution for smaller projects? Is it easy to replace in the future? Know any good (and preferably cheap) alternatives?

Authentication and Identity management are just one giant shit fuck.
Ldap, PAM, OAuth and what not.
Each of them with it's own caveats.

Ldap, supposedly being the most widely used, isn't even an actual Identity management or authentication service, but just a DB misused as one.

The best part is, that if you want to selfhost some apps, you're pretty much forced to host one of these abominations too.
At least if you don't want to manage each service account's separately.

Am I incredibly paranoid with my idea of multiple(>2)-factor-auth like fingerprint+yubikey+password+OTP aso?

I don't get it

why is it that people still use FTP?

Like, in current, fairly recent (2018) projects, for public downloads.
I get that when you're just hosting public files without any authentication you don't need to worry about the unencrypted passwords, but like
the random ports are a shitty and annoying practice and also http exists just let your custom patcher program download the release from github where it's already available

Why must all the information about API authentication with Angular must be either outdated or shitty explained?
If anybody have some good, working angular+express server code, please share that to me...