New answers tagged

0

The answers so far make good points, I just wanted to add that there are well-regarded sites that do 2FA differently than how you describe. Notably, Google will ask you for your email, password and 2FA on individual pages, making the UI much cleaner and smoother. One approach I particularly like is from the Internet Banking for one local bank (george.csas.cz)...


0

As others have pointed out is likely most sites choose to perform 2 separate stages, because the 2nd factor is optional, either due to some accounts not needing a second factor or some kind of "remembered device" mechanism. Again as others have pointed out, many implementations choose to leak information by only challenging for the 2nd factor after ...


1

I want to answer the question with your exact scenario in mind, something I think others haven't done: A website where all users are required to set up 2FA using Time-based One-time Password (TOTP), à la Authenticator app (I personally prefer Microsoft's over Google's), and not other forms of 2FA. There is one major reason why asking for the TOTP should be ...


1

It is generally considered good practice to submit and check all credentials in one go. If you only ask for the second factor after validating the first, you’re leaking information about the validity of that password, which can then be tested with the username in other, non-2FA web sites. Please also note that “factor” means one of the following: 1 something ...


22

In most websites, 2FA are optional. The site can only know whether the user needs 2FA after the user enters their username. Additionally, most sites requires successfully authenticating the password as well to display the 2FA box because otherwise an attacker can do an amount enumeration attack and figure out which users have 2FA enabled or not. Also, some ...


63

I think you're misinterpreting what actually happens. It's not doing the second factor (SMS code, authenticator app) after login is successful, but simply after one factor (password) has been verified. The state between the two authentication methods is still not logged in. Your question, then, might be "why not send all factors at once", and ...


0

Here's an example. I started with a template someone else wrote, but I can't find it, so here it is as I've edited: Source: https://gist.github.com/earonesty/ccee25a56be7adeb5f670cf44e5fa479 Coding Guidelines General These are not to be blindly followed; strive to understand these and ask when in doubt. Sometimes standards are a bad idea. Don't duplicate ...


0

The advice he got in college was probably about working with the outdated computing systems of the time, and not about how you should or shouldn't write programs. So he's essentially saying that a modern IDE on a fast machine is great. Which is true, but not all that interesting. He would have started Cornell in 1982(?), in Philosophy but probably played ...


1

I clearly remember that I definitely did this when I started to program. While I was young and fresh and was just getting to know the world of code, this was what I did most of the time. But as time went on and I gathered experience, I started relying on this less and less. To the point where I don't do it at all today anymore. The reason is that with ...


2

This phenomenon is called survivorship bias, with the part about highly competitive careers being especially relevant. In particular, to correct Paul Graham on this: As far as I can tell, the way they taught me to program in college was all wrong. You should figure out programs as you're writing them, just as writers and painters and architects do. No, I ...


2

Not all programs are the same. Strategies that work for programs that search a problem space for one correct answer are different from enterprise software that's heavy with ever-changing business logic. "It depends" is never a satisfying answer, but the bottom line here is that there's no answer to your title question without looking at specifics. ...


0

Designing a program before you write it is not necessarily a bad thing. Expression of design The problem is that designs have to be expressed somehow, and programmers are generally not equipped with any better way of expressing a design than with the code itself. Code is directly executable by computer, and communicable to other programmers, because it is ...


2

It's important to realize this question of how to approach the software development process is not only about what software is being written but also who is writing it and in what environment. I think the reason there are so many different opinions on how software development should be approached is because different methods work best for different people. ...


19

TL;DR Both methodologies have real world applications. Both methodologies can be overapplied and lead to inefficient results. Paul Graham is focusing solely on newbie programmers, overstating himself, or he's overapplying his methodology to the point of being detrimental. This is classic agile vs waterfall Agile and Waterfall are two development ideologies ...


4

"Sketching" and "Upfront Design" don't necessarily contradict but complement each other. They are somewhat related to bottom-up and top-down approaches. It's necessary to have a big picture of what you're building, but the building process can be made more efficient if you work with building blocks that were developed bottom-up. Just as a ...


5

What they teach you in school is not all wrong, it is just one verifiable way to teach you to think things over and not rush to the first goal you can think of. The sketching process you describe using your code editor is basically the same as writing out Nassi-Schneiderman diagrams upfront on paper. The point is to not skip the planning phase and to remain ...


Top 50 recent answers are included