New answers tagged authentication
Can't use OAuth2 protocol for that. Having authenticated user once, system issues access token to it. This token will be sent with an each request. Oauth2 has several flows. They are primarily for end-user, but for server-to-server interaction you can use two-legged OAuth like Google Data API uses now.
Just how many users are you expecting to have? I've worked with systems that have hundreds of thousands of users and have never felt the need for sharding (just proper indexing). And, of course, you're not actually storing the password, are you ...
If you do have to go with re-sharding, one way to do this is to use another database table to store the actual account and host/table mapping. Mapping table contains only key fields to lookup on which are optimized for performance (id, name, email) and rest of the account data is in the table that the mapping table points to. This gives the most flexible ...
If you are making a standard web app, then TLS is your only "safe" method of protecting users from MitM attacks and traffic sniffing. Take a look at ipviking's map of real time cyber attacks; a large number come from China because encryption is largely outlawed and browser requests can get hijacked. (Most infosec guys I know agree that X.509 is broken, the ...
Security questions are useless. They do not add security but annoy the hell out of the users. Do what serious companies do and verify identity via cell phone or just send a password reset link to the associated email (case in point: Stack Exchange).
can't you just compare the strings the user enters? To prevent sniffing, you have to encrypt the answers on the client, pass your server's public key to the client and use it to encrypt them before passing them back to the server. Alternatively, just use SSL comms.
Top 50 recent answers are included