<story><title>Show HN: Evilpass – A slightly evil password strength checker</title><url>https://github.com/SirCmpwn/evilpass?</url></story><parent_chain><item><author>jfroma</author><text>This server-side call to Twitter, Facebook etc is a bad idea. I understand you are trying to educate your users with a nice UX but let&amp;#x27;s say this software is running on USA but the user trying to sign up is based on France, the attempt of login can trigger anomaly detection algorithms (eg: impossible travel) and the user might receive an email from Twitter &amp;quot;someone has login across the pond with your password, if is not you please change immediately&amp;quot;.&lt;p&gt;There are a lot of things that can be done though. Facebook and Netflix [1] for instance are crawling the web for leaks and pastes, once they find one of their user&amp;#x27;s password they will force the user to change their password. Auth0 is a authentication-as-a-service and we offer this as a feature [2].&lt;p&gt;I have worked on this feature and several related features, my advice is don&amp;#x27;t ask for a password in your public website. If you think is easy, you are wrong, it is a lot of work to code it correctly but it is also a lot of work maintaining the system. Brute force protection, anomaly detection, detecting when your user password has been leak by a third party, etc. It is simpler to authenticate by using a third party like google, you just have to be careful about implementing oauth flows correctly.&lt;p&gt;DISCLAIMER: I work for Auth0.&lt;p&gt;1: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.dailymail.co.uk&amp;#x2F;sciencetech&amp;#x2F;article-3628950&amp;#x2F;Time-change-password-Facebook-Netflix-asking-users-tighten-account-security-following-major-breaches.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.dailymail.co.uk&amp;#x2F;sciencetech&amp;#x2F;article-3628950&amp;#x2F;Time-...&lt;/a&gt;&lt;p&gt;2: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;auth0.com&amp;#x2F;blog&amp;#x2F;announcing-password-breach-detection&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;auth0.com&amp;#x2F;blog&amp;#x2F;announcing-password-breach-detection&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>sametmax</author><text>Using a 3rd party to login is nice and all but:&lt;p&gt;- if the party and you don&amp;#x27;t get along anymore, the accounts are dead. Some business are still counting the money lost from cloudflare deciding the underlying site is not respecting their conditions anymore. Same for Google translate. Auth is no different.&lt;p&gt;- if it has a technical failure, it&amp;#x27;s impossible to login. If you think it never happens, think again. We hear about a failure every year for some big companies. Because you don&amp;#x27;t have access to the code, you can&amp;#x27;t implement a quick fallback and must wait until they fix it.&lt;p&gt;- if their 3rd party account is compromised your site is as well. &amp;quot;Someone pirated my facebook&amp;quot; is something I heard to many time. It just meant that a close person from them maliciously used their account by accessing their computer when they were away, gaining access to everything.&lt;p&gt;- if their API changes, you need to change your code. Meaning you need to follow up on each providers. This can have a huge cost and the GAFAS really don&amp;#x27;t care and change their API at will.&lt;p&gt;- if the user closed their 3rd party account, they can&amp;#x27;t login anymore. This one is terrible : when I closed my gmail account, I became locked out of many services with not way of recovering them.&lt;p&gt;And then let&amp;#x27;s say you have one sass for auth (Oauth provider X), one for the db (firebase), one for map (gmap), one for static files (ES2), one for your messages (CloudAMQP) and so one.&lt;p&gt;Basically you own nothing in your infrastructure. You have no control on anything, you are dependent of a lot of things, and they all have you &amp;quot;clicked here to agree&amp;quot; on a lonnnng legal text that will update regularly and be affected by market and politics, across various countries.&lt;p&gt;Your entire business is at the mercy of others.</text></comment>
<story><title>Show HN: Evilpass – A slightly evil password strength checker</title><url>https://github.com/SirCmpwn/evilpass?</url></story><parent_chain><item><author>jfroma</author><text>This server-side call to Twitter, Facebook etc is a bad idea. I understand you are trying to educate your users with a nice UX but let&amp;#x27;s say this software is running on USA but the user trying to sign up is based on France, the attempt of login can trigger anomaly detection algorithms (eg: impossible travel) and the user might receive an email from Twitter &amp;quot;someone has login across the pond with your password, if is not you please change immediately&amp;quot;.&lt;p&gt;There are a lot of things that can be done though. Facebook and Netflix [1] for instance are crawling the web for leaks and pastes, once they find one of their user&amp;#x27;s password they will force the user to change their password. Auth0 is a authentication-as-a-service and we offer this as a feature [2].&lt;p&gt;I have worked on this feature and several related features, my advice is don&amp;#x27;t ask for a password in your public website. If you think is easy, you are wrong, it is a lot of work to code it correctly but it is also a lot of work maintaining the system. Brute force protection, anomaly detection, detecting when your user password has been leak by a third party, etc. It is simpler to authenticate by using a third party like google, you just have to be careful about implementing oauth flows correctly.&lt;p&gt;DISCLAIMER: I work for Auth0.&lt;p&gt;1: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.dailymail.co.uk&amp;#x2F;sciencetech&amp;#x2F;article-3628950&amp;#x2F;Time-change-password-Facebook-Netflix-asking-users-tighten-account-security-following-major-breaches.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.dailymail.co.uk&amp;#x2F;sciencetech&amp;#x2F;article-3628950&amp;#x2F;Time-...&lt;/a&gt;&lt;p&gt;2: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;auth0.com&amp;#x2F;blog&amp;#x2F;announcing-password-breach-detection&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;auth0.com&amp;#x2F;blog&amp;#x2F;announcing-password-breach-detection&amp;#x2F;&lt;/a&gt;</text></item></parent_chain><comment><author>Sir_Cmpwn</author><text>This isn&amp;#x27;t intended for serious use, it&amp;#x27;s just intended to raise awareness about the dangers of password reuse. Also, Twitter sent me 2FA SMS messages during testing.</text></comment>