Why should we outsource sign-on services instead of building by ourselves?
By: Angus Chiu
Tags: Passwordless, Login, Authentication, Single Sign On, Magic Link

Photo by Shahadat Rahman on Unsplash

Implementing a good sign-on solution is non-trivial

As a developer, although we may think ditching passwords by signing on through email is a good idea, one key thing to keep in mind is that any sign-on solution has to be implemented well to be secure and effective. If we have some experience in software engineering, we all know the gulf of difference between “making things work” and “making things right”. Implementing a passwordless email sign-on flow is one thing; making it easy to use, fail-safe, and resistant to attack is another. It requires a great deal of knowledge and know-how in cybersecurity to ensure that everything is done correctly.

To illustrate the hard work involved in building passwordless login from scratch, let’s take a look at what needs to be done.

You need SMTP service or spin up a SMTP server.

Perhaps the most straightforward way to do is to subscribe to an Email Service Provider (ESP) such as SendGrid or Mailchimp, and use their SMTP servers, but that comes with a price tag.

Or, if you (the developer) decide to spin up a SMTP server, you’ll also need to take care of below:

Configure SPF (Sender Policy Framework) Configure DKIM (DomainKeys Identified Mail) Once SPF and DKIM are in place, you’ll also need DMARC (Domain-Based Message Authentication Reporting and Conformance) Regular inspect DMARC reports and analyzing if any fraudulent behaviors are observed that would affect your spam rating, like spender spoofing.

Got to say, spinning up and maintain a SMTP server can be a daunting task, and is easy to get it wrong.

You will need to design and implement entire security solution

Once you’ve settled with your email solution, you will need to develop a mechanism to verify and grant sign-on status to customers. The mechanism to generate a secret link, issuing secure token, and all the threats or exploits that may happen during the sign-in process will need to be considered and properly handled, so that the system can fend off bad actors from trying to impersonate end users or harming your system. Measures against DDoS, MITM attack may need to be implemented as well.

You will need to implement entire login flows and its peripheral flows

As the developer, you are responsible to handle all the “happy paths”, “ alternate paths” and “bad path” in entire user sign-on process, including:

Happy path like:

First-time sign-up Successful sign-in Successful Sign-out

Alternative path like

User idle for long period of time User login to another device Request to change email address System have not received verification for too long User request to use multiple emails to same credential User request to cancel their previous email credential

Bad path like

JWT token expired, missing or unverified User re-use verification URL

Photo by Mikael Seegen on Unsplash

It is all on you to handle exceptions or distress scenario (like being attacked)

You may need to handle some shady scenarios — Like create mechanisms to take care of, e.g. crafted JWTs trying to impersonate someone else or executing downgrade attack, etc.

Like create mechanisms to take care of, e.g. crafted JWTs trying to impersonate someone else or executing downgrade attack, etc. You will need to troubleshoot — In the case that bad actors mimic new users and triggered thousands of verification email, causing users’ mail gateway to take defensive measures and reject the verification email sent from your SMTP servers, troubleshooting will need to commence.

— In the case that bad actors mimic new users and triggered thousands of verification email, causing users’ mail gateway to take defensive measures and reject the verification email sent from your SMTP servers, troubleshooting will need to commence. High availability is crucial — And then, since the sign-on service is mission-critical component of the entire service, developers may need to consider design the system with high-availability capability so that it is resilient to system or network failure, and auto-scalable so it is more responsive when the loading rate is high.

And then, since the sign-on service is mission-critical component of the entire service, developers may need to consider design the system with high-availability capability so that it is resilient to system or network failure, and auto-scalable so it is more responsive when the loading rate is high. You properly need someone to audit your system — From time to time, depends on the nature of the application, development team may need to hire external security experts to undergo security check or conduct penetration testings against the servers.

From time to time, depends on the nature of the application, development team may need to hire external security experts to undergo security check or conduct penetration testings against the servers. You also need to have a well thought out UX that fight against social engineering attack — If security is critical to the service provider (and it usually does), the verification email sent to customers should be carefully designed, so that customers can easily distinguish the legitimate verification email from the forgery verification email sent by hackers trying to trick users into visiting malicious web sites.

If security is critical to the service provider (and it usually does), the verification email sent to customers should be carefully designed, so that customers can easily distinguish the legitimate verification email from the forgery verification email sent by hackers trying to trick users into visiting malicious web sites. The commitment is never-ending— The efforts against different kinds of attack are complicated and never-ceasing, not all online services can handle the workload.

Shouldn’t developers focus on improving the online experience of their core business, instead of wasting time on the race of cybersecurity?

Professional Passwordless sign-on service come to rescue

Luckily, there are already some SaaS start-up (like Divao.io) that come into the space to solve this problem. Divao offers a low-code, passwordless sign-on solution to anyone who wish to deliver state-of-the-art sign-on solution to their customers.

By integrating Divao.io’s JavaScript libraries into the landing page (auxiliary server-side API integration for more advanced features), Divao takes care of all the heavy-lifting of passwordless sign-on, with a highly polished user flow to guide the customers to through the sign-up / sign-in process. Once the customer is verified, customer browser will return to the landing page, presenting a JSON Web Token (JWT) to service provider. The JWT, digitally-signed by Divao, is proof that customer identity has been verified by Divao to onboard to the system.

If you wish to know more about Divao passwordless sign-on, please visit divao.io for more information, or simply visit demo.divao.io to experience it!

It’s time to ditch the passwords and embrace passwordless!

Reference

Login with my password? I don’t want any passwords!

Visit our website in Divao.io