&quot;Don&#x27;t roll your own authentication&quot; seems to me to be even more pertinent advice than &quot;Don&#x27;t roll your own encryption&quot; as it&#x27;s a much more common mistake that I see at almost every single place I&#x27;ve worked at. I think it&#x27;s not a common phrase because authentication is really not that hard and most engineers think they can do it properly. My experience, at least, shows that they can&#x27;t. Everything from plaintext passwords to symmetric encryption happens and it happens at companies one would expect would implement some security. I&#x27;ve seen CTOs and Engineering Directors argue against changing the plaintext passwords till they were blue in the face and I just gave up. Obviously, our industry has done little to educate people on this issue and in almost every single major breach, it&#x27;s easy to see how this was a key factor in making the leak worse by leaking the actual passwords or their improperly stored &quot;hashes&quot; (because in some cases they&#x27;re not even hashes).