BeerAndCodeSeattle/BeerAndCode — Issue #24: Passwords should not be stored
Author: DustinVenegas
Created: 2011-12-26 06:34:50+00:00
State: open

I saw that the application is currently storing passwords in a database. To decrease our security concerns I would like to propose that we only use OpenId, OAuth, or similar 3rd party authentication services. This will ensure that in the event the database is compromised our users would have nothing to worry about.

This would require us to perform a one time "setup" where an administrator account is set via a one-time use page or via bootstrap scripts. After the database is bootstrapped this step would not need to be performed again.

Both authentication methods we're evaluating support 3rd party authentication.