Tag Info

Hot answers tagged

10

It doesn't have to be unique. But if it's not it makes your life more difficult. Having a unique username means there is only one possible password for that username. If it's wrong, you don't have to go looking for another user with the same username to compare it to. It's gets really complicated when someone requests a missing password. How do you know who ...


8

I wrote an answer, then read a little more, and substatially edited my answer. This question has already been debated on Stack Overflow. The accepted answer on this question is a good starting point, follow the links. My take is that: The static salt (which you call global) is somewhat valuable because: It is simple to implement, and doesn't require a ...


8

It depends on your target audience - there's no right answer. Especially if you are trying to use your website as a business, you need to focus on your audience. Ease of implementation should be a secondary concern, especially since both Facebook Connect and OpenID have been implemented by a number of sites, you should be able to easily get tutorials. It ...


8

Captcha.


7

The biggest thing that comes to mind is, "How are you going to handle moderation?" StackExchange avoids a lot of spam because it is self-moderated. However, if you don't allow your users to moderate or you don't have users willing to moderate, the onus falls on you. Moderation becomes much easier if you require authentication.


7

I've used MediaWiki as a CMS on quite a few occasions, though my goal has been to publish (i.e. allow anyone else to view and only editors access to write) content but restrict edit access. To lock down write privileges: $wgGroupPermissions['*']['createaccount'] = false; $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['editpage'] = ...


7

A couple reasons come to mind: The signup process is awaiting e-mail verification. It's not uncommon to force users to verify their e-mail addresses before allowing them access to a service (particularly if the service is concerned about spammers or plans to send promotional e-mails to account holders). Forcing the user to enter the credentials they just ...


7

Yes, if the site requires authentication then robots will not be able to crawl it. You can also specify a robots.txt file so that the entire site is disallowed


6

It matters as much as you and your users thinks it matters. Sending passwords over http as plain text does leave them vulnerable to packet sniffing. Now whether someone is going to actually bother sniffing those packets is a whole other story. If you want to ensure your users the most secure experience possible, use SSL for their login submissions. If you ...


6

From my standpoint of a user, I expect my OpenID providers to be around a long time. I wouldn't want the service that's allowing me to log into a number of sites to disappear overnight. That's why I use Google and Verisign as my providers (Verisign being my primary simply because they offered it before Google did). I would never use a new upstart service as ...


5

Do they have to be unique? No. Should they be unique? Depends upon what you think should happen when two users with the same username and password both try logging in at the same time.


5

I'm not a UI/UX specialist, but based on my experience I would do the following: keep a boring but grandpa-recognizable links "Log In" and "Sign Up" at top right corner. make a nice call-to-action button "Become a ninja" and place it on the page content, linking to "sign up" page.


5

HTML is not meant for this. HTML just displays content in a web browser. You will need a server side programming language like PHP to do this. The PHP will take the form submission (which is in HTML) and do the work that checks if the users is valid, and if they are, log them in.


5

I think the StackOverflow blog covers it quite well: Several lesser providers (Technorati, Vidoop, Mozilla Weave) went belly-up, leaving their users stranded with no way to authenticate. Occasionally OpenID providers will have bugs or service outages — even big ones like Yahoo. Fortunately this is quite rare, but it does happen, and troubleshooting ...


5

Don't put auth directives inside a Proxy directive, put it inside a Directory directive for '/usr/share/moin/server'.


4

Some quick Googling gave me this: http://sldn.softlayer.com/wiki/index.php/SoftLayer_Network_ContentDelivery_Authentication_Token Looks like, at least with SoftLayer, you can set a token on the user's machine that lets them authenticate with the CDN, thus allowing access to the content. I'm sure this ability varies based on CDN.


4

Word press has an openid plugin. I am not sure if it works with the other login services. This plugin can do also other services like Quickly register and login users with their existing accounts from Facebook, Twitter, Google, Yahoo!, LinkedIn, Windows Live, MySpace, AOL or OpenID


4

If you look at it from the standpoint of Return on Investment (ROI) it makes little sense to become an OpenID provider unless you have a massive user base. The value of companies like Google being an OpenID provider is that they get more people to visit their site and more people to tightly integrate and work with them. This offsets the technical, ...


4

I think OpenID and Facebook log in integration are about equal in their complexity for the site user. Either can be useful, what really matters is what is your target audience. If your goal is to do something that works well with Facebook and is for the general masses then Facebook integration is the way to go. Also, will the people using the site ...


4

A generic non-application way to force an entire directory and its subdirectories to use SSL can be achieved with Apache: Options +FollowSymlinks RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} Simply put that in a the .htaccess file of the directory you wish to secure. If you put it in your root directory it ...


4

This pretty much has already been asked on StackOverflow: Double salt for hashing passwords?


4

Facebook login integration will let you do just about anything you want. One complaint people have is that it changes pretty often and that you need to invest a decent amount of time in keeping up with it. If your goal is to stick with Facebook only and use a lot of the more advanced features then there is value in using it. However, if you are looking ...


4

Spam and bots. If you signup and are instantly in and able to post or interact with the site, whats stopping you from logging out doing it again and doing it nonstop? Nothing. By making you login you have to at least memorize the data you put into the login name and password fields, which is a step not all bots have built in so you're instantly knocking out ...


4

check out the following page. Gives a run down on the open id libraries out and about depending on your platform. http://wiki.openid.net/w/page/12995176/Libraries


4

But what's the point of this type of activity? Your guess is as good as anyone's - perhaps the operator is mistakenly trying to access a set of spam accounts created elsewhere? (or ones which were supposed to be created at your site but failed for whatever reason) Edit: ... speaking to your initial question: How should a site respond to automated ...


4

Real two factor authentication introduces another level of security by getting users to login with their username and password and then say a code generated on their phone or via a card/code generator (Barclays Bank sent out card readers that generate a use once code based on your card swipe. Splitting the username and password on to two different pages ...


4

The only reason that I've seen the two step login as you describe it be more secure is if the username entered on the first page is matched to some sort of image or phrase that the user chooses when they register. This helps the site verify itself. If someone were to copy your site to use in a phishing campaign, they wouldn't be able to display the image ...


4

The only reasoning I can come up with involves preventing automated attacks. Where the username and password are both accepted on one page, it's relatively simple to create an automated script that will hammer that page with username and password combinations until something gets through - called a "Brute force" attack, for obvious reasons. Having your ...


4

You may find this discussion on the Orchard codeplex site useful: http://orchard.codeplex.com/discussions/230525#post506416 ...here's a working AutoLoginController for those that are interested. It uses Active Directory...


4

Maybe one of these is of use for you: opauth to interface with authentication providers or uLogin for adding secure login and authentication capabilities. You would be able to develop the specifics on your own (remember me ...) but make a great use of proven basics.



Only top voted, non community-wiki answers of a minimum length are eligible