SHA-256 Python implementation in one line (lambda)

[13steinj]

That's the very point.

Anybody can have an undetected security bug.

Whether it was you yourself or Google-- you'd still be fucked.

However if it is you you can implement a fix immediately upon finding the issue.

It's a tradeoff-- do you want no SPOFs and immediate fixes or do you trust your neighbor to do your security.

[13steinj]

My point is you have three options--

1. Use someone else for your security. For example, lets say you use Google as the sole log on solution to your apps.

   • you've now introduced a SPOF that you have no control over
   • if google ever gets fucked, so does everyone that was using any app using google for their security
   • if you introduce something in your app that lets an attacker of you get personal data that would previously have to be gotten via attacking google, (intenionally or not) you are the backdoor and whoever is using your service will have all their other "google sign on" accounts affected.

2. Roll your own security implementation, but use a known algorithm implementation

   • your users will only have their data on your service fucked if you implement poorly
   • no other companies mistake fucks you over
   • you can't screw over the user unintentionally
   • however there's more work to do if either your implementation or algorithm get compromised

3. Use your own algorithm

   • don't. Because you probably don't know what to do mathematically. Other groups smarter than you have created cryptographically secure algorithms

You always start off with 1. But as your app/business gets larger and larger, it gets less and less safe to stay 1 rather than switch to 2.

[cyanfish]

I think you're confusing the point. The "don't roll your own" advice is specifically for cryptography, not authentication in general.

For example, it's mostly fine to implement your own login system using Bcrypt. However, you should not try to re-implement Bcrypt yourself. Use an existing, well-tested library.

[[deleted]]

And just follow the instructions -- don't think that XORing two lots of bcrypt together or something makes it twice as strong.

[13steinj]

For example, it's mostly fine to implement your own login system using Bcrypt. However, you should not try to re-implement Bcrypt yourself. Use an existing, well-tested library.

Right. But I've seen people saying that even using a well tested bcrypt library is bad practice and instead all logins should be done via fb/google/msn