March 2019 Summaries

FusionAuth 1.5 introduces a passwordless login feature, enhancing security by allowing authentication via a secure email link instead of traditional passwords. This update aims to address the common security issues associated with password management, offering a simpler and more secure alternative that is already in use by major services like Microsoft's suite of applications and recommended by the World Wide Web Consortium (W3C). Alongside passwordless login, the release includes various updates and fixes, such as improved support for OAuth2 and OpenID Connect, enhanced two-factor authentication workflows, and a reduction in the Docker build size. FusionAuth continues to evolve as a flexible and powerful identity and access management solution, offering a wide range of features for user authentication and management.

The text discusses the impact of the European Union’s General Data Protection Regulation (GDPR), which has led to many companies updating their privacy policies and terms of service to comply with user rights such as the "right to erasure." It highlights how FusionAuth, a customer identity and access management solution, uses webhooks to handle user data deletion requests in compliance with GDPR. Webhooks in FusionAuth are event-driven notifications that can trigger actions within applications, such as deleting a user's data upon account deletion. The article provides a detailed guide on setting up a webhook in FusionAuth to listen for the 'user.delete' event, ensuring user data is removed before account deletion is completed. It also outlines how to configure webhooks using the FusionAuth UI, emphasizing the importance of transaction settings to ensure successful data deletion. Additionally, the post provides a code example using Node.js and Express to illustrate how to implement a webhook that verifies requests via an API key and deletes user data, thus maintaining synchronization between the application database and the FusionAuth user database. The article concludes by promoting FusionAuth’s features, including registration, login, and user management, and invites readers to learn more and engage with the community for support.

FusionAuth has integrated Gravatar, enabling users to carry their avatars across platforms effortlessly. With an existing Gravatar account, users can see their avatars without additional setup, while those without an account will receive a randomly generated Gravatar. Gravatar allows users to register email addresses, associating them with avatars that appear on all Gravatar-supported platforms. FusionAuth requires no coding for this integration, although coding enthusiasts can explore provided examples, including a Java snippet for generating Gravatar URLs. FusionAuth positions itself as a flexible and secure Customer Identity and Access Management solution, offering features like registration, login, SSO, and more, free for unlimited users.

Storing or emailing plaintext passwords poses significant security risks, as it makes sensitive information easily accessible to hackers and increases vulnerabilities, especially if databases are compromised or emails intercepted. CU Boulder and other organizations still engage in this risky practice, jeopardizing user data regardless of password complexity. Best practices to mitigate these risks include hashing passwords with strong algorithms like bcrypt, avoiding plaintext password emails by using secure password reset links, implementing multi-factor authentication for added security, and allowing users to set their own passwords rather than sending temporary ones via email. FusionAuth offers a flexible and secure Customer Identity and Access Management solution that includes features like password hashing and multi-factor authentication, aiming to enhance security while being free for unlimited users.

The GDPR emphasizes "data protection by design and default," requiring companies to follow adaptable principles for maintaining data privacy, which FusionAuth addresses through a robust REST API designed to facilitate compliance. FusionAuth's CEO, Brian Pontarelli, highlighted how the API supports GDPR adherence by providing functionalities such as data retrieval, deletion, correction, and protection, alongside identity security and consent management, allowing developers to implement these features with ease. FusionAuth's solution offers a flexible and secure Customer Identity and Access Management system, providing services like registration, login, and user management for free, making it an appealing option for companies aiming to meet GDPR requirements while managing customer identities effectively.