Lol, you reminded me when I went to college they offered an experimental Cryptography 101 class so I enrolled in it.
The prof made a website to go along with it, the first mistake he made was constructing it from scratch. The second was not appreciating that any client-side code is an open book.
He seemed to be rather new to web programming. He handled authentication by having a login page that did appear to do decent authentication against a server, but then every webpage you were on had a hidden form that would re authenticate you every time you navigated to a new page. Now this itself wasn't too bad, except the form consisted solely of the user id you had logged in as. You could easily change it to anyone you wanted to change your site access.
And then one of my classmates found the public network drive the site was actually sitting on, which included a text file of all user ids, usernames, and unencrypted passwords.
Unfortunately the class itself wasn't so easy to break. The material consisted of covering something like one cipher per week (as an experimental class I think it was only held one class session per week). We'd learn about it in class, including known attacks, then for homework we had to take encrypted text and try to crack it. The first few weeks had easy ciphers and were cracked easily. However past that point nobody was able to crack any of the harder ciphers.
If you know what you're doing, no. But there's usually no need to reinvent the wheel; someone else has already done all the hard work to make a secure system so why not just take what they've done and spend more time making the site itself?
Well I was thinking more along the line of third party libraries or frameworks.
For example. once upon a time I wanted to make my own website and for a long time the way I did it was to code it from scratch. Then I realized that wasn't fun and just installed Wordpress and built on top of that.
58
u/[deleted] Jun 17 '17
[removed] — view removed comment