[MUSIC PLAYING]
PETER FRIESE: Hey, everyone.
Welcome to another episode of "Better Safe Than Sorry."
I'm here today with Rachel.
Hey, Rachel, how's it going?
RACHEL MYERS: Hi, Peter, I'm happy to be here.
PETER FRIESE: So today I want to talk with you about something
I've been working on for a couple of days.
So here, I've got a phone application
and I've implemented a sign up screen.
I wanted to get your opinion about it.
RACHEL MYERS: What are you using for authentication, Peter?
PETER FRIESE: So I was thinking to use email and password
authentication, because it's so easy to get started with.
What do you think?
RACHEL MYERS: I think that it definitely seems easy at first,
but it's harder to do well than you would think.
PETER FRIESE: Hmm.
Why is that?
RACHEL MYERS: Well, to start, it's hard for users.
They have to remember a password or, if they're
using a password manager, they have to manage their password.
PETER FRIESE: I remember when I started
using email and passwords a long while ago,
I used passwords that I could remember.
And I realized that was not a good thing.
So I started using password managers to manage that for me
and to enable me to use really strong passwords.
RACHEL MYERS: Yeah, I think that it's a great move
if you have to have passwords.
But a lot of people aren't as technical as you.
And they might not know about password managers,
they might not know how to use them.
So a lot of people are still just remembering
their passwords.
PETER FRIESE: OK, cool.
So I, or not cool.
I mean, I guess we need to find a way
to make it easier for them to create strong enough passwords,
right?
So that's probably something that we need to talk about.
But from my perspective as a developer,
it's super simple to implement email and password
authentication.
I mean, look at the code for the application.
It's literally just one line of code.
RACHEL MYERS: Firebase Authentication
does make it really easy to implement authentication.
That's true.
But if you look at it more closely,
it can be harder to implement well.
PETER FRIESE: Why is that?
RACHEL MYERS: One thing that you might
want to add that I don't see here
is something around a password recovery flow.
PETER FRIESE: Why do you think that's important?
I mean, like users come up with the password
and then they memorize it or they store it
in their password manager.
Why do they need to recover the password?
RACHEL MYERS: Well, they might forget it.
And then they want, you don't want to just lock them out
of the app.
And there is a way in the console
to send a reset password, but you can't really scale that up.
That means that your users have to get in contact with you,
and you have to send out the reset.
PETER FRIESE: Yeah, yeah, for sure.
I wouldn't want my users to call me in the middle of the night,
especially if my app is viral and I get millions
of new users in a short time.
Yeah, for sure.
OK, so password verification flow is an important thing.
What else is important?
RACHEL MYERS: So you mentioned password verification, or user
verification, and that's another thing that's really important.
You want to have a way to know for sure that the user who's
signing up actually has the email address that they're
using to sign up.
PETER FRIESE: I get email every now and then where
it seems like somebody signed up for some service
and then they used my email address probably accidentally,
so I receive email saying, hey, your so-and-so is ready,
come pick it up.
And apparently, it's another person.
So that's one case of that, right?
RACHEL MYERS: Yeah.
And that sounds like it was someone unintentionally
typoing their email address and accidentally ending up
on your email address.
It's also possible for someone to knowingly use a wrong email.
So if I signed up for an account for your app with an email
that I know is not my email, I might
want to keep someone else from being
able to use that email address.
Or if someone does a password reset,
then they would have access to the account that I created.
So it just gets into this very murky water,
and you want to always make sure that you're
verifying email addresses.
PETER FRIESE: Yeah, I can see why that's important.
So one way to do that would probably
be to take the email address that user input into the form,
and then send it to my server.
The server sends them an email with a link.
That's a deep link.
They click on the link, they come back into my application
and it carries a code, and then I
can verify that this has been the user who
signed up for the app in the first place, right?
Would that be OK?
RACHEL MYERS: Yeah.
And Firebase Authentication makes that pretty smooth to do.
You can look at the Firebase UI implementation
of how we do a password verification, or sorry, a user
verification, to have an idea of how we're making that work.
PETER FRIESE: So we want to make sure
that the user actually exists.
We have the password recovery flow.
Oh, yeah, and then probably password strength, right?
That's another thing.
What's your suggestion there?
RACHEL MYERS: If you're going to use passwords,
it's really good to help users choose good passwords.
You're going to have to do a lot of this on the client side,
but I think you want to walk a balance between helping
them choose a good password and being too prescriptive.
Because if they're using a password manager,
their password managers are already
going to do a lot of this work for you,
and you don't want to fight their password
manager by having very specific requirements.
So I stick to something around length.
I want to say it has to be 20 characters.
PETER FRIESE: Mm-hmm.
RACHEL MYERS: And I might require
it to be an uppercase and a lowercase,
because most password managers are already doing that.
PETER FRIESE: Mm-hmm.
RACHEL MYERS: So I'm not fighting their password
manager, and I'm still helping users choose good password.
PETER FRIESE: I remember seeing an API that
allows you to do that using the operating system support.
So, for example, on iOS you can say,
hey, this input field here is a new password field,
or it's for a one-time code or it's just
for inputting your password.
And then the operating system will
detect that this is for a new password,
and it will suggest a strong password.
And then the user doesn't have to come up with one,
and the operating system will also
store it in its built-in password manager.
RACHEL MYERS: So I love these operating
system-specific password managers.
The only drawback is that it's a little bit
tricky if you initially create your account on one platform
and then you need to use the password on another platform.
So that's a limitation.
And honestly, I prefer just getting out of the password
business altogether.
PETER FRIESE: Are you referring to Federated identity
providers, like Sign-In with Apple or Google Sign-In?
RACHEL MYERS: That's one that I really like.
I especially like Sign-In with Apple
because they are verifying all email addresses, which
is great.
The other thing that I really like
is Sign-In with Email and link.
The way that works is, when someone signs up
for an account, it sends them an email.
And then to sign in, they click the link
in the email to sign in.
So it's getting us out of the business of passwords.
And it's always verifying the email address, which is great.
PETER FRIESE: That sounds pretty cool.
I think I would love to talk more about this in detail,
but we're already a little bit short on time.
So how about we do another video just about those?
RACHEL MYERS: I would love to.
PETER FRIESE: OK, cool.
And that was another episode of "Better Safe Than Sorry,"
where we talk about everything authentication and security
to help you build better and safer apps.
Thanks for watching.
Stay safe, and we will see you in the next one.