Tag Info

Hot answers tagged

10

It doesn't have to be unique. But if it's not it makes your life more difficult. Having a unique username means there is only one possible password for that username. If it's wrong, you don't have to go looking for another user with the same username to compare it to. It's gets really complicated when someone requests a missing password. How do you know who ...


8

It depends on your target audience - there's no right answer. Especially if you are trying to use your website as a business, you need to focus on your audience. Ease of implementation should be a secondary concern, especially since both Facebook Connect and OpenID have been implemented by a number of sites, you should be able to easily get tutorials. It ...


8

I wrote an answer, then read a little more, and substatially edited my answer. This question has already been debated on Stack Overflow. The accepted answer on this question is a good starting point, follow the links. My take is that: The static salt (which you call global) is somewhat valuable because: It is simple to implement, and doesn't require a ...


7

A couple reasons come to mind: The signup process is awaiting e-mail verification. It's not uncommon to force users to verify their e-mail addresses before allowing them access to a service (particularly if the service is concerned about spammers or plans to send promotional e-mails to account holders). Forcing the user to enter the credentials they just ...


7

The biggest thing that comes to mind is, "How are you going to handle moderation?" StackExchange avoids a lot of spam because it is self-moderated. However, if you don't allow your users to moderate or you don't have users willing to moderate, the onus falls on you. Moderation becomes much easier if you require authentication.


7

I've used MediaWiki as a CMS on quite a few occasions, though my goal has been to publish (i.e. allow anyone else to view and only editors access to write) content but restrict edit access. To lock down write privileges: $wgGroupPermissions['*']['createaccount'] = false; $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['editpage'] = ...


6

It matters as much as you and your users thinks it matters. Sending passwords over http as plain text does leave them vulnerable to packet sniffing. Now whether someone is going to actually bother sniffing those packets is a whole other story. If you want to ensure your users the most secure experience possible, use SSL for their login submissions. If you ...


6

From my standpoint of a user, I expect my OpenID providers to be around a long time. I wouldn't want the service that's allowing me to log into a number of sites to disappear overnight. That's why I use Google and Verisign as my providers (Verisign being my primary simply because they offered it before Google did). I would never use a new upstart service as ...


5

I'm not a UI/UX specialist, but based on my experience I would do the following: keep a boring but grandpa-recognizable links "Log In" and "Sign Up" at top right corner. make a nice call-to-action button "Become a ninja" and place it on the page content, linking to "sign up" page.


5

I think the StackOverflow blog covers it quite well: Several lesser providers (Technorati, Vidoop, Mozilla Weave) went belly-up, leaving their users stranded with no way to authenticate. Occasionally OpenID providers will have bugs or service outages — even big ones like Yahoo. Fortunately this is quite rare, but it does happen, and troubleshooting ...


4

If you look at it from the standpoint of Return on Investment (ROI) it makes little sense to become an OpenID provider unless you have a massive user base. The value of companies like Google being an OpenID provider is that they get more people to visit their site and more people to tightly integrate and work with them. This offsets the technical, ...


4

Some quick Googling gave me this: http://sldn.softlayer.com/wiki/index.php/SoftLayer_Network_ContentDelivery_Authentication_Token Looks like, at least with SoftLayer, you can set a token on the user's machine that lets them authenticate with the CDN, thus allowing access to the content. I'm sure this ability varies based on CDN.


4

Word press has an openid plugin. I am not sure if it works with the other login services. This plugin can do also other services like Quickly register and login users with their existing accounts from Facebook, Twitter, Google, Yahoo!, LinkedIn, Windows Live, MySpace, AOL or OpenID


4

I think OpenID and Facebook log in integration are about equal in their complexity for the site user. Either can be useful, what really matters is what is your target audience. If your goal is to do something that works well with Facebook and is for the general masses then Facebook integration is the way to go. Also, will the people using the site ...


4

A generic non-application way to force an entire directory and its subdirectories to use SSL can be achieved with Apache: Options +FollowSymlinks RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} Simply put that in a the .htaccess file of the directory you wish to secure. If you put it in your root directory it ...


4

Spam and bots. If you signup and are instantly in and able to post or interact with the site, whats stopping you from logging out doing it again and doing it nonstop? Nothing. By making you login you have to at least memorize the data you put into the login name and password fields, which is a step not all bots have built in so you're instantly knocking out ...


4

Facebook login integration will let you do just about anything you want. One complaint people have is that it changes pretty often and that you need to invest a decent amount of time in keeping up with it. If your goal is to stick with Facebook only and use a lot of the more advanced features then there is value in using it. However, if you are looking ...


4

But what's the point of this type of activity? Your guess is as good as anyone's - perhaps the operator is mistakenly trying to access a set of spam accounts created elsewhere? (or ones which were supposed to be created at your site but failed for whatever reason) Edit: ... speaking to your initial question: How should a site respond to automated ...


4

Real two factor authentication introduces another level of security by getting users to login with their username and password and then say a code generated on their phone or via a card/code generator (Barclays Bank sent out card readers that generate a use once code based on your card swipe. Splitting the username and password on to two different pages ...


4

The only reason that I've seen the two step login as you describe it be more secure is if the username entered on the first page is matched to some sort of image or phrase that the user chooses when they register. This helps the site verify itself. If someone were to copy your site to use in a phishing campaign, they wouldn't be able to display the image ...


4

The only reasoning I can come up with involves preventing automated attacks. Where the username and password are both accepted on one page, it's relatively simple to create an automated script that will hammer that page with username and password combinations until something gets through - called a "Brute force" attack, for obvious reasons. Having your ...


4

You may find this discussion on the Orchard codeplex site useful: http://orchard.codeplex.com/discussions/230525#post506416 ...here's a working AutoLoginController for those that are interested. It uses Active Directory...


4

Maybe one of these is of use for you: opauth to interface with authentication providers or uLogin for adding secure login and authentication capabilities. You would be able to develop the specifics on your own (remember me ...) but make a great use of proven basics.


4

This heavily depends on the target of the audience. For developers, I would offer a Login via Github. For all other matters, having a sign in via Facebook AND Twitter would not hurt. What my company tough observed was, that even tough we are offering the login via Twitter and Facebook, 95% of the Users just sign in via a regular new account.


4

There is no simple solution to this problem. Static passwords may be shared among friends. Tracking mechanisms (IP-addresses, cookies) will turn up "false positives" (i.e. rejecting real paying members) - which is very bad for business. Using a OTP (One Time Password), as suggested by Steve, is probably not practical, as it does not allow casual use, and ...


3

These days I will not register with a website if the website has not already proved its greate value to me. However I am more willing to login with Facebook or gmail (openID) as I don't have the pain of yet another password. So if you website MUST make people log in, then you are likely to get more users with Facebook connect and openId. However remember ...


3

Preventing cross-site scripting attacks by "escaping" the contents (i.e. prevent any HTML/script being interpreted as such when you serve them back up) would help stop abuse. Also, if you allow links in comments then including the rel="nofollow" HTML attribute negates the value of people doing so just to game search engines. You could "teach" the site to ...


3

Figured it out. So, you: SETTING IT UP: Create a PAGE, Have the default login module ONLY display on the PAGE using the BLOCK config settings. On load have BLOCKS set to ONLY display content to users of that ROLE. ISSUES: Down side is that a user that has NOT logged in will see the page TITLE, and a user that is able to login will see the same page ...


3

Taking the opposite approach to John's answer, I think you should seriously consider SSL if you handle any personally-identifiable information - to include: names with physical addresses, e-mail addresses, financial information, and communications which users would reasonably expect to be private. Unless your site provides a means for users to publish ...


3

A good way is to do this is have users login with email addresses and add a database field "nickname", which you set like "user3452" when the user registers and the user can change it to anything they want. But he still has to login with his email. More users with the same username is a way to hell.



Only top voted, non community-wiki answers of a minimum length are eligible