New answers tagged

3

If you're going to offer an irreversible destructive operation like this, forcing reauthentication sounds like an excellent idea. See https://developers.facebook.com/docs/facebook-login/reauthentication for how to do it with Facebook. That said, I would lean towards also making deletion recoverable for some period. Eventually you'll encounter a case where ...


1

The original answer was based on a wrong assumption, since I haven't followed the link provided in the question. I edited the answer now, but kept the original version at the bottom, since it may be helpful. Talking about the wide usage, I would assert that a similar system exists in nearly every website under a form “I forgot my password”. Using ...


1

Security is not a new problem Issue certificates Public Key Infrastructure certificate based authentication over username and password authentication


3

Use OAuth 2.0. Google, Microsoft, Facebook, Twitter, and many more are reputable OAuth 2.0 providers that you can validate users against. You can authorize a client or a server without having to store user id and passwords. For example, if you have a web server, you can use this to authenticate clients: ...


2

I think the best approach is to use other authenticating agencies; Google, Facebook, LinkedIn, Github, etc. This approach involves using oAuth (typically) and would involve the smallest surprise for your users. The downside of this approach is the end user must have at least one of these accounts to access your app.



Top 50 recent answers are included