.Net Dojo: Forgot Your Password Workflow

As an experienced web developer, I have seen all kinds of crazy login workflows. The security question workflow, however, is the absolute dumbest workflow ever. Not only are most questions geared at public domain information, but how many people are actually going to remember what they typed in for their answer? Also, depending on how good (or bad) the programmers are, if the answer is case senstive, or miss-spelled, you are hosed. I can’t stand sites who use this workflow when there are much better, and more secure ways to allow users to regain control of their account. To learn more about why this type of authentication is bad, read Wish it was Two-Factor by Alex Papadimoulis. He discusses how the secret question does not fullfill two factor authentication by any means.

.Net Dojo: Custom Configuration

A best practice in .Net development is to have as much of your code in reusable libraries as possible. This cuts down on development time and helps enforce business standards across all applications. One problem however is that sometimes reusable libraries need to have a few customizations. The easiest way is to create a Settings file and set each property through the use of the app.config or web.config.

A more complicated solution is to create your own custom configurations. In my case, I have an enormous library that consists of different parts. I have database tools, data caching, encryption, cookie management, querystring management, Infocard support, email wrappers, as well as several other useful tools. Being a perfectionist, I like to have my settings split out by the piece they belong to. Sure, there is more xml in the config file, but, if I only want to use one section of my code I don’t need to have the whole configuration. Plus, having the configurations split out means I can easily split my library up into multiple DLL’s down the road.