Ask HN: How do you currently solve authentication?
Another thing to bare in mind, for those who are rolling their own, is how you caress those passwords from the DB.<p>The common approach is a simple DB SQL select. But that then means if your web server gets exploited an attacker can dump the entire password database.<p>The safer option is to write a stored procedures to return or modify that table and set permissions on that table so even your web app creds can’t directly query the password table. Then your web service only has access to check a single password, rather than downloading every hash on the DB.<p>If you can also offload the encryption&#x2F;decryption and hashing then that is another step forward too.