In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: OpenID connect, "sign in with Google" or "Facebook", etc.
I am curious to understand more about these topics. I recently moved from a very large tech company to a much smaller one, and in my current company, they have a practice of storing user passwords in a database. They salt and hash the passwords, but I think that trying to manage security and cryptography themselves is biting off more than they can chew. In my research, I found this (source: Stanford University) and wondered if this community had any thoughts about the claims made here (this is a little dated..."Facebook" for example is mentioned, although I wondered if these recommendations are still relevant today).
For clarity, this is from a lecture entitled, "Bad (Attitude) Guide to Computer Security". So it is likely that the author is making these big claims with a kind of playfulness. I'm asking the question here to better understand the actual concepts and the seriousness of the claim (along the lines of, "is this a total joke that shouldn't be taken seriously at all, or is there actually a good lesson in this advice?")
Password hashing is bad.
- Password hashing is bad because it makes you think it's okay for users to send you their passwords.
- Users should not send you their passwords.
- Your site security should not depend on your enforcement of a password complexity requirement.
- You do not want a server compromise to expose anything that allows a bad guy to intercept or crack user passwords.
- Better: Delegate. Use public-key auth, or "Log in with Google" / "Log in with Facebook" / OpenID Connect.