I’m not a security expert myself, not even close, but for more than once, I’ve been greatly concerned about the risks for having accounts in several websites. I wonder myself why did the developers there go with the decisions that bad.
It’s already bad enough to use HTTP on your register/login page . It’s even worse when you send me my password in plain text. Either the one I chose or the one you randomly generated for me.
And this has happened more than once. Each time, it raises my eyebrows higher and higher. I don’t want to rant here – but it takes great deal of ignorance or laziness, or both, do do such as bad practice about securities.
Luckily, this is not common (I would be crazy if it is). Still, there are still measures to take to ensure the security of your site:
- Enable HTTPS/SSL for your login/register page, if not your entire site. Certificate is cheap and the processing power is non-issue nowadays.
- Did you know that long passwords are better than complex passwords? So if you want to enforce any password rule, make sure to enforce the length. Any other rules can be annoying while ineffective.
- Never store a plain password anywhere, ever. Sending an mail is a way of storing. Avoid it at all cost. For “Forget password” function, use a link, and even better, make it invalid after a time period, such as 24 hours.
- Normal hash functions, like MD5, SHA-1, etc. are not secure. Use the best, most secure encrypt methods in a well-known library. Currently, they are probably scrypt or bcrypt. Leave the implementation detail to the best, smartest security experts – you can’t have done better.
- Two factor authentication is a very good addition. Apply it when possible.
Again, I’m not a security expert – these are just bare minimum requirements of what you should do. If you value your customers’ privacy and safety, always have security experts audited your code and process.
Security is not a thing to be taken lightly. It does not come free, but if you can invest properly, it can cost you a great deal to fix.
