Unfortunately its a common misconception, it feels easy, however auth is a lot more harder to do it right, specially when it comes to recovery. A simple example, protocol like TOTP (time based OTP) uses the concept of shared secret and almost every implementation stores the secret as it is in their databases
I never suggested not to do, this was not the intention. I was just sharing the fact that its not easy. Also doing auth can have different level of depths too so its highly subjective on goals.
Comments
Unfortunately its a common misconception, it feels easy, however auth is a lot more harder to do it right, specially when it comes to recovery. A simple example, protocol like TOTP (time based OTP) uses the concept of shared secret and almost every implementation stores the secret as it is in their databases
I gotta say, this is not a very strong argument for not doing auth yourself.
I never suggested not to do, this was not the intention. I was just sharing the fact that its not easy. Also doing auth can have different level of depths too so its highly subjective on goals.