Latest / DevQuestions with Tim Corey / 128 What Authentication System Should I Use For My App?

Transcript

128 What Authentication System Should I Use For My App? · DevQuestions with Tim Corey

• 0:00
  SPEAKER_01: Welcome to the Dev Questions Podcast with Tim Corey.
• 0:03
  SPEAKER_01: Join us each episode as we tackle the questions you are asking about a career in software development, understanding the industry, and new technology.
• 0:12
  SPEAKER_01: If you're just starting out or you want to grow stronger as a developer, this is the place to get your questions answered.
• 0:19
  SPEAKER_01: Now, here's your host, expert developer and online educator, Tim Corey.
• 0:24
  SPEAKER_02: What authentication system should I use for my app?
• 0:27
  SPEAKER_02: This is a question that came up on the suggestion site.
• 0:30
  SPEAKER_02: I thought I'd tackle it in today's episode of DevQuestions.
• 0:33
  SPEAKER_02: Now, if you have a suggestion, go to suggestions.iamtimcorey.com, leave that suggestion there, and hopefully you'll see your question answered on a future episode of DevQuestions.
• 0:43
  SPEAKER_02: So let's dive into what's the right authentication system for my app.
• 0:47
  SPEAKER_02: Now we're specifically talking about C sharp apps, but this really applies in general to any coding application of any type.
• 0:55
  SPEAKER_02: And let's start off with my philosophy on authentication.
• 1:00
  SPEAKER_02: And I think this is a very important philosophy.
• 1:02
  SPEAKER_02: I think it's one that you should adopt as well, but let me see what you what your thoughts are.
• 1:06
  SPEAKER_02: My philosophy is don't do it yourself.
• 1:10
  SPEAKER_02: That's it.
• 1:12
  SPEAKER_02: That's the big one.
• 1:13
  SPEAKER_02: I see a lot of people create their own authentication system, especially when they're starting out off where they say, well, it's just a username and password.
• 1:22
  SPEAKER_02: No big deal.
• 1:23
  SPEAKER_02: I'll just check the password, make sure it's right, and then we're good to go.
• 1:27
  SPEAKER_02: There is so much more to an authentication system than that.
• 1:31
  SPEAKER_02: Don't do that.
• 1:32
  SPEAKER_02: Think of authentication like a bank.
• 1:34
  SPEAKER_02: You know, you can have a safe in your own house.
• 1:37
  SPEAKER_02: That works fine for you.
• 1:38
  SPEAKER_02: Uh price shouldn't be your only way of storing money.
• 1:42
  SPEAKER_02: But for small stuff, no big deal.
• 1:45
  SPEAKER_02: And if you have your own personal application and you create your own authentication system just for yourself, and it's a small little thing that's just for you and doesn't have a lot of impact if you were to lose everything, no big deal.
• 1:58
  SPEAKER_02: But that's kind of like that little safe in your closet or wherever in your house.
• 2:04
  SPEAKER_02: But imagine if you had a business.
• 2:07
  SPEAKER_02: Maybe let's say you sell cookies and you decide, you know, I'm going to store all of my customer information, all of my money, all of the credit card information for future charges, all of that I'll store in my safe in my house.
• 2:26
  SPEAKER_02: Does that sound like a good idea?
• 2:28
  SPEAKER_02: No, it doesn't, because there's so much more to storing and securing that besides just having it in a locked box.
• 2:36
  SPEAKER_02: I mean, if you're strong enough, you can go pick that box up and walk out of the house with it.
• 2:41
  SPEAKER_02: And theft does happen.
• 2:43
  SPEAKER_02: So you don't want to see a business do that with your information.
• 2:46
  SPEAKER_02: You wouldn't want to do that with somebody else's information.
• 2:49
  SPEAKER_02: And that's why we have banks, because banks store our money and allow us to do a lot of stuff with it, transfer money and make sure that it's, you know, when you take money out that's properly recorded.
• 3:01
  SPEAKER_02: And when you put money in, it's properly recorded.
• 3:04
  SPEAKER_02: Who can take money out or put money in is important.
• 3:06
  SPEAKER_02: And all those other things they they provide around just storing money in a safe.
• 3:12
  SPEAKER_02: There's a lot more to it.
• 3:14
  SPEAKER_02: And that's the same thing with authentication.
• 3:16
  SPEAKER_02: There's a lot more to it than just saying, does this username match and password match?
• 3:22
  SPEAKER_02: Is this the correct pair?
• 3:24
  SPEAKER_02: There's a lot more to it.
• 3:25
  SPEAKER_02: And so don't roll your own.
• 3:28
  SPEAKER_02: Now, there are a few different authentication systems or types of systems.
• 3:34
  SPEAKER_02: So let's talk about the different levels, I would say, of an authentication and authorization system.
• 3:40
  SPEAKER_02: And we're gonna just call it authentication, but really authentication and authorization are two different things.
• 3:46
  SPEAKER_02: They're different parts of the same thing, really.
• 3:49
  SPEAKER_02: Where one says, are you who you say you are?
• 3:52
  SPEAKER_02: authentication, and authorization says, do you have access to this?
• 3:57
  SPEAKER_02: Okay.
• 3:58
  SPEAKER_02: There's two different parts there.
• 4:00
  SPEAKER_02: They really work together in a lot of ways.
• 4:02
  SPEAKER_02: So we're just gonna call it the auth system or authentication system for simplicity of talking.
• 4:07
  SPEAKER_02: Okay.
• 4:08
  SPEAKER_02: So there's different levels of an auth system.
• 4:11
  SPEAKER_02: And the first one, I'm gonna call it level zero, don't do this.
• 4:15
  SPEAKER_02: And that is a self-created system, a system you built yourself that you create all of the security code for.
• 4:24
  SPEAKER_02: Okay, that's the don't do this level.
• 4:26
  SPEAKER_02: Then there's the self-hosted system, a system that somebody else built, but that you host.
• 4:32
  SPEAKER_02: For example, if you use ASP.NET Core, you'll probably know that there's a built-in authentication system, Microsoft Identity, that's built in, but you host it in your own entity framework-generated database.
• 4:46
  SPEAKER_02: That's kind of level one, okay?
• 4:48
  SPEAKER_02: And that's built right in.
• 4:50
  SPEAKER_02: That can be a decent system.
• 4:52
  SPEAKER_02: We'll talk more about it in a minute.
• 4:54
  SPEAKER_02: Now, number two, I'd say, is that same self-hosted system, but you use a third-party OAuth provider, such as Twitter, Facebook, Microsoft, GitHub, all those to authenticate the user.
• 5:08
  SPEAKER_02: So they put in their Twitter credentials or their GitHub credentials, and then you know, if you put in GitHub credentials, GitHub says, yes, that is Tim.
• 5:17
  SPEAKER_02: And that's the authentication part that's done by GitHub, which means you've offloaded a lot of work on the GitHub because they handle password resets and they handle verification, they handle two-factor authentication possibly, or many other things they can do, but they handle it.
• 5:36
  SPEAKER_02: But then they tell you, okay, yes, Tim is who he says he is.
• 5:40
  SPEAKER_02: And then you can say, okay, then I'm going to authenticate him for my system, and I'm going to authorize him to do certain things.
• 5:48
  SPEAKER_02: So that's self-hosted.
• 5:49
  SPEAKER_02: It's still that same entity framework database or some other local thing that you own.
• 5:54
  SPEAKER_02: But you're using a third-party OAuth to authenticate a person.
• 5:59
  SPEAKER_02: And then there's the next level up, uh, which would be the third party hosted.
• 6:04
  SPEAKER_02: So everything is hosted by a third party, uh, Azure Active Directory or Azure Active Directory B2C, uh, Auth Zero, Okta, and there's many more out there.
• 6:15
  SPEAKER_02: But these are systems where you probably pay something in order to have them do all the work.
• 6:22
  SPEAKER_02: Okay.
• 6:22
  SPEAKER_02: That's kind of like level three on this list.
• 6:25
  SPEAKER_02: And then level four is that same thing, Azure AD or B to C or whoever else, but also using OAuth from third parties as well.
• 6:35
  SPEAKER_02: So maybe you have an Azure AD B to C account, but you also allow them to authenticate using GitHub.
• 6:42
  SPEAKER_02: Okay.
• 6:42
  SPEAKER_02: So that's kind of the four levels that I see, plus level zero, which is don't do this.
• 6:47
  SPEAKER_02: Um that's the different options you have.
• 6:51
  SPEAKER_02: Which one is best?
• 6:53
  SPEAKER_02: Well, it does depend on your situation.
• 6:56
  SPEAKER_02: That's really the answer for most questions.
• 6:58
  SPEAKER_02: It depends.
• 6:59
  SPEAKER_02: But what does it depend on?
• 7:01
  SPEAKER_02: And we'll talk more about that.
• 7:03
  SPEAKER_02: But the big deal is to make sure that you choose what's right, not just based off finances, but also based upon what the data is and how sensitive it is.
• 7:15
  SPEAKER_02: Okay.
• 7:15
  SPEAKER_02: The more sensitive data, the more you should spend in making sure it's secure and safe.
• 7:21
  SPEAKER_02: Okay.
• 7:22
  SPEAKER_02: So you want to have, you know, an ideal for third party is storage for storage.
• 7:30
  SPEAKER_02: That's the ideal.
• 7:30
  SPEAKER_02: So go with third party for storage.
• 7:32
  SPEAKER_02: That's probably the best option.
• 7:34
  SPEAKER_02: And the reason why is because what is authentication?
• 7:39
  SPEAKER_02: What is authorization?
• 7:40
  SPEAKER_02: What are you doing?
• 7:40
  SPEAKER_02: You're trying to secure something.
• 7:43
  SPEAKER_02: Well, what's more secure?
• 7:46
  SPEAKER_02: A one safe in a closet where maybe people have access even to that closet?
• 7:52
  SPEAKER_02: Or if you want a safe inside of a warehouse that's guarded by security, inside of an organization that tracks and monitors who comes onto the property.
• 8:01
  SPEAKER_02: Like there's different levels, right?
• 8:03
  SPEAKER_02: So when it comes to your safety or data, maybe it's better, it is better, if you let somebody else do that as opposed to your one little rinky dink server, right?
• 8:15
  SPEAKER_02: Um, and there may be some pushback there and say, well, but we control a server, and so no data goes outside, and so it's all inside of our walls.
• 8:23
  SPEAKER_02: Cool, I get that.
• 8:25
  SPEAKER_02: But that's not really how you handle finances.
• 8:29
  SPEAKER_02: You don't just say, well, we're gonna handle storing all the cash in our business because it's inside our walls, because that wouldn't be safe.
• 8:37
  SPEAKER_02: Well, why is it you do the same, you do that with authentication, where you say, we want it all inside of our walls.
• 8:44
  SPEAKER_02: Because unless you're all internal users, if you have external users, they're coming in and out, and now you have to make sure that your walls are tall enough, that your uh walls are protected and guarded and monitored and all these other things that a third party provides.
• 9:04
  SPEAKER_02: And you have to have that same level of security for one authentication system as opposed to their hundreds and thousands of authentication systems.
• 9:13
  SPEAKER_02: The economy of scale says the person who has hundreds and thousands can do more for cheaper.
• 9:20
  SPEAKER_02: Okay.
• 9:21
  SPEAKER_02: So ideal, third party for storage.
• 9:24
  SPEAKER_02: And ideal, and this is again my opinion here, ideal is that same third party for authentication instead of using OAuth.
• 9:34
  SPEAKER_02: And that may blow some people's minds.
• 9:35
  SPEAKER_02: They're like, wait, wait, wait, those OAuths are great because we can reuse those same credentials and let them do half the work.
• 9:42
  SPEAKER_02: I get that, but there's some downsides too.
• 9:46
  SPEAKER_02: Okay, let's talk through some of the downsides.
• 9:49
  SPEAKER_02: For instance, if you say you can authenticate through my site or through Microsoft or GitHub or Twitter or Facebook, right?
• 9:59
  SPEAKER_02: So those four options.
• 10:01
  SPEAKER_02: And a person decides, you know what, I'm gonna use GitHub and they authenticate through GitHub.
• 10:06
  SPEAKER_02: Well, now when they come back the next time, and maybe it's been a year since they've come back, which one did I choose?
• 10:13
  SPEAKER_02: I've got all four of those things.
• 10:14
  SPEAKER_02: Which one did I choose?
• 10:16
  SPEAKER_02: Now, there are some systems to help you with, okay, I selected this, but I actually I do this with um sessionize, which is a way for speakers to um submit sessions for potential conferences and speaking at conferences.
• 10:30
  SPEAKER_02: And they have, I think, six different authentication options besides login.
• 10:35
  SPEAKER_02: And I use one of the social logins, but I always have to remember which one was it.
• 10:40
  SPEAKER_02: I think it was Google.
• 10:42
  SPEAKER_02: But in order to do it, I click on the wrong one and it goes, no, I think we've got an account over here.
• 10:47
  SPEAKER_02: But here's a tricky bit.
• 10:49
  SPEAKER_02: Not all of my socials use the same email address.
• 10:53
  SPEAKER_02: So how would it know that my work email address is the same as my personal email address?
• 10:59
  SPEAKER_02: It doesn't always do that.
• 11:00
  SPEAKER_02: So now I have two different accounts with that same platform.
• 11:04
  SPEAKER_02: So that can be tricky.
• 11:06
  SPEAKER_02: But also, here's another thing.
• 11:08
  SPEAKER_02: What if I use my GitHub credentials and somebody has access to those GitHub credentials?
• 11:16
  SPEAKER_02: Maybe for whatever reason you shouldn't do this, but maybe I shared my GitHub credentials with someone in order to get them into my GitHub real quick to do something.
• 11:26
  SPEAKER_02: Well, now they could also log in to your site.
• 11:31
  SPEAKER_02: So that the the third-party OAuth systems are nice and they do offer a quick way in.
• 11:40
  SPEAKER_02: I love it when people support uh the Apple login because on my phone I say, yep, Apple login, boom, done.
• 11:48
  SPEAKER_02: But now we're relying on my Apple login not being stolen.
• 11:52
  SPEAKER_02: So there's a lot of question marks around that where it adds to your ability to quickly get in.
• 12:01
  SPEAKER_02: It reduces the number of passwords people have, it makes it easier, but does it make it safer?
• 12:08
  SPEAKER_02: That's the question.
• 12:09
  SPEAKER_02: And the answer is it's going to depend on your situation.
• 12:14
  SPEAKER_02: So if you want the safest, you probably want to have that third party do the authentication separately from an OAuth system.
• 12:22
  SPEAKER_02: That way you don't have to alert people if, hey, if your password is stole on Twitter, then you should also check to make sure you reset the password here or reset tokens, or and yes, there's a lot of systems in place to help with that already.
• 12:35
  SPEAKER_02: And they've made things a lot better, so it's a lot harder to have a person who steals your credentials over here, use it over here, but it still can't happen.
• 12:46
  SPEAKER_02: So ideally, I would say use a third party for your authentication system and use that same third party to do the login in, password, two-factor authentication, all the rest for that user.
• 13:03
  SPEAKER_02: Don't try to separate that out if you want the most secure.
• 13:09
  SPEAKER_02: And that's what we're talking about here is the most secure.
• 13:12
  SPEAKER_02: You need to choose what's best for your sliding scale of risk.
• 13:18
  SPEAKER_02: And that's an important part to talk about is security is a matter of risk assessment and mitigation.
• 13:25
  SPEAKER_02: Okay.
• 13:26
  SPEAKER_02: You need to figure out what is the risk compared to the reward.
• 13:31
  SPEAKER_02: All right.
• 13:32
  SPEAKER_02: So, really simple example.
• 13:34
  SPEAKER_02: If you go to imtimcore.com, you don't have to log in.
• 13:38
  SPEAKER_02: Well, that's because there's no reward for logging in.
• 13:43
  SPEAKER_02: There's no reason to ask people to log in.
• 13:46
  SPEAKER_02: What's the risk?
• 13:47
  SPEAKER_02: There isn't one because there's no data being protected behind a password there.
• 13:53
  SPEAKER_02: Now, if you were to put your credentials in and buy something from me, and you want to manage your subscription to the All Access Pass, well, yes, that's behind some protections because of the fact that the risk of not having it behind protections is people will steal your information.
• 14:12
  SPEAKER_02: So I have to I use a third-party system to handle authentication in that case, and they protect your data.
• 14:19
  SPEAKER_02: So you gotta figure that balance there between risk and reward.
• 14:24
  SPEAKER_02: If you're doing a small app that uh protects basically nothing, then you can have a much lower bar for your security.
• 14:33
  SPEAKER_02: Uh I used a pretty decent bar for my security for the suggestion site.
• 14:38
  SPEAKER_02: So you go to suggestions.imtimcorey.com.
• 14:41
  SPEAKER_02: Again, you can leave a suggestion for a future dev question.
• 14:44
  SPEAKER_02: But in there, what are you gonna steal?
• 14:47
  SPEAKER_02: Okay, let's just say, for whatever reason, I decide to publish your usernames and passwords.
• 14:53
  SPEAKER_02: Now I can't because I don't have access to them.
• 14:56
  SPEAKER_02: But let's just pretend I did and I published it.
• 15:00
  SPEAKER_02: What's the worst that can happen?
• 15:02
  SPEAKER_02: Someone can post a suggestion as you?
• 15:05
  SPEAKER_02: Like, that's not a big deal.
• 15:07
  SPEAKER_02: So the the risks are pretty low.
• 15:10
  SPEAKER_02: Now that means I can be a lot more free with what things I offer as far as ease of use, um, how long I keep the token open for, and you know, what authentication systems I can allow, and if I allow third-party OAuth and all that other stuff, I can be pretty open because there's not very risk.
• 15:33
  SPEAKER_02: Now, if I am storing your credit card information, your social security information, or your personally identifiable information that's sensitive, um, your health records.
• 15:47
  SPEAKER_02: Those are really important things to make sure you have a high level of security on.
• 15:54
  SPEAKER_02: You probably shouldn't just say, eh, whatever.
• 15:57
  SPEAKER_02: Now, just to be clear, I didn't say, eh, whatever either.
• 16:01
  SPEAKER_02: I use Azure Active Directory B2C in order to authenticate you on a suggestion site.
• 16:08
  SPEAKER_02: That is a third-party system, and I currently do not have third-party OAuths turned on.
• 16:15
  SPEAKER_02: So you can't use Twitter or Facebook or Microsoft or GitHub or any of those at this point.
• 16:21
  SPEAKER_02: We're just saying, hey, you have to create an account through us and through our BFC account.
• 16:28
  SPEAKER_02: That way it's totally separate, separate login and password, and it's protected.
• 16:32
  SPEAKER_02: Now, that's a pretty high walled garden around not much, the suggestion site.
• 16:39
  SPEAKER_02: But just kind of a future preview, we're not gonna just stop there with suggestion site.
• 16:44
  SPEAKER_02: There's more things coming where you can reuse those same credentials.
• 16:48
  SPEAKER_02: So that's why we want to keep the bar pretty high on that site.
• 16:51
  SPEAKER_02: But it's up to you to make the right choice for your situation.
• 16:55
  SPEAKER_02: So make the best possible decision for your business and your customers.
• 17:01
  SPEAKER_02: All right.
• 17:02
  SPEAKER_02: So when I say business and customers, sometimes people come to me and say, well, this one's free.
• 17:09
  SPEAKER_02: And that's great for a small application.
• 17:12
  SPEAKER_02: That's great for an application with no real stop to secure.
• 17:16
  SPEAKER_02: But as soon as you have real customers, as soon as you have real data to secure, and real data can just be email addresses.
• 17:24
  SPEAKER_02: It can be just, you know, your middle name or your zip code or things that you probably shouldn't just publish without permission.
• 17:33
  SPEAKER_02: So once you get to that point, you need to start thinking about not just what does it cost, but how do I safely protect your customers?
• 17:43
  SPEAKER_02: Because if you don't protect your customers, and let's say you have a data breach, that could be a major issue.
• 17:51
  SPEAKER_02: And you want to be able to say, I did my best, not I did my cheapest.
• 17:57
  SPEAKER_02: Okay.
• 17:58
  SPEAKER_02: So when you're thinking about authentication, there's a wide spectrum of options.
• 18:02
  SPEAKER_02: Um, again, don't choose to do your own, like build your own security system.
• 18:08
  SPEAKER_02: That's really, I almost want to say never, but there is a very, very, very, very, very slight case where you're doing a personal application on your personal computer that's never going anywhere, that doesn't talk to the internet at all, and that does something little, but you want to make sure you protect it a little bit.
• 18:27
  SPEAKER_02: Okay, maybe.
• 18:28
  SPEAKER_02: But there is such a small percentage of cases where you would build your own authentication system.
• 18:34
  SPEAKER_02: Now, Microsoft identity, that's not building your own.
• 18:37
  SPEAKER_02: That's using what Microsoft has created.
• 18:40
  SPEAKER_02: And you're hosting it locally, and yet the code has been built by Microsoft and is maintained and updated by Microsoft.
• 18:48
  SPEAKER_02: So that's not quite the same thing.
• 18:51
  SPEAKER_02: But it's still a lower level of security than, say, hosting it in Azure Active Directory and letting them handle the authentication and even authorization of your users.
• 19:02
  SPEAKER_02: So figure out what works best for you, but try to think about not just the bottom line of cost, but also the bottom line of cost of what happens when this gets breached.
• 19:15
  SPEAKER_02: Because security breaches happen all the time.
• 19:18
  SPEAKER_02: And they're not always because this super elite hacker got crazy access and did some crazy stuff.
• 19:26
  SPEAKER_02: Sometimes it's you were cheap and there's a known exploit that you didn't know about because you didn't pay attention to it.
• 19:34
  SPEAKER_02: You didn't read up on your security system, you didn't know how to configure it, and someone just used the default credentials or something else like that.
• 19:42
  SPEAKER_02: So be careful, know your system, and make the best choice for both your business and your customers.
• 19:49
  SPEAKER_02: Okay, so that's a kind of a broad answer.
• 19:52
  SPEAKER_02: I can't give you specifics because it does depend on your situation.
• 19:55
  SPEAKER_02: Um, but think that through.
• 19:58
  SPEAKER_02: Think through what you want to be able to say if your data was breached.
• 20:04
  SPEAKER_02: Do you want to be able to say it was cheap?
• 20:07
  SPEAKER_02: Or do you want to be able to say, I did my best based upon the circumstances?
• 20:11
  SPEAKER_02: Okay.
• 20:11
  SPEAKER_02: So that's my answer to the question: which authentication system should we use?
• 20:15
  SPEAKER_02: All right.
• 20:16
  SPEAKER_02: If you have a question, again, go to a suggestion sites.
• 20:18
  SPEAKER_02: Thanks for listening.
• 20:19
  SPEAKER_02: And as always, I am Tim Corey.
• 20:21
  SPEAKER_00: Thank you for joining us for this episode of Def Questions.
• 20:24
  SPEAKER_00: Tim is committed to making it easier for you to become a developer.
• 20:28
  SPEAKER_00: If you would like to help make more content like this possible, please like, subscribe, rate, and share Deaf Questions.
• 20:35
  SPEAKER_00: You can also send your questions to questions at IamTimcorey.com.
• 20:40
  SPEAKER_00: Until next time, remember, you are too smart and your time too valuable to waste it making all the mistakes Tim did.
• 20:47
  SPEAKER_00: When you're ready to learn to think and code like a professional developer, head over to imtimcore.com and enroll in a course.