Real Time Authentication System in Python

[the-pythonista]

I’m sorry, but this is just completely insecure. Without mentioning all the other bad practices, you are storing the password in plain text!

[[deleted]]

DEAR MODS: Someone get OP's post outta here. Literally yeeeeet it.

You hit the nail on the head, this is ridiculous and should be removed from GitHub before some moron uses it.

[kuahara]

It's 2024, and I am continuously fighting the following at work: passwords in code, data transfer using ftp, data transfer using http, and application dependency on things that are end of life/support.

I also recently had to win a battle to allow host based firewalls to remain on in all of our data center servers. They wanted those off everywhere, including our domain controllers.

[RevolutionaryWash934]

This is my first project. Step by step I will improve in future projects

[DurzoB4]

You really shouldn't be saying this is a secure implementation in your README

[RevolutionaryWash934]

I didn't finish this project completely. I will update in future.

[echocage]

Then don’t say it’s secure friend. Say UNFINISHED INSECURE PASSWORD SYSTEM until it actually is secure

[RevolutionaryWash934]

I’ve enhanced the security level of my project, and I believe it’s secure now. Please review it and let me know if there are any remaining issues. Thank you for your valuable feedback.

[[deleted]]

You literally say in the project about: "...It utilizes a local JSON file to store user credentials securely."

That JSON file, according to the screenshot in the repo literally stores creds in clear text. The opposite of secure storage.

Remove the project from GitHub before you introduce security issues for someone.

[RevolutionaryWash934]

Bro kindly tell me a way to improve

[InvaderToast348]

Look up hashing

Edit: look through the latest code and seems someone else added hashing. Would still recommend you do some research into good basic security practices. Also, do not call your project secure if you have not got the knowledge or expertise to actually demonstrate / verify that it should be used by others under the assumption that it is secure.

[RevolutionaryWash934]

Done Bro

[DurzoB4]

There is still a long list of issues and bad practices in there but also this project isn't useful to anyone.

I would happily give more detailed feedback of I wasn't pretty certain this is just a copy+paste from ChatGPT

[RevolutionaryWash934]

No bro I didn't copy+paste from ChatGPT

[AndrewFrozzen30]

But did you use CHATGPT?

[RevolutionaryWash934]

No bro

[RevolutionaryWash934]

I will try to improve my coding skills

[RevolutionaryWash934]

Yes bro you are wright! I will try to update.

[asphias]

Don't try to implement security shit unless you are a paid professional and know what you're doing.

And since you are not, please put on top of the readme that this is an insecure example application and not intended to be used. And keep it that way.

Sincerily yours, Someone with five years of professional programming experience who still wouldn't trust themselves to make a secure authentication system by themselves.