Is this question salvageable?

The definitive guide to form-based website authentication

I see multiple, severe problems with this old question from 2008 and I am tempted to delete it outright -- primarily because the most highly voted answers read more like blog rants than actual "answers".

But I wanted to get the community's feedback first. What say you?

edit: I decided to clean up and merge all these "sections" into one answer. I'll leave a comment on the post pointing back here.

closed as off-topic by ᔕᖺᘎᕊ, S.L. Barth, Wrzlprmft, Fish Below the Ice, gnat Jul 15 '15 at 13:02

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question pertains only to a specific site in the Stack Exchange Network. Questions on Meta Stack Exchange should pertain to our network or software that drives it as a whole, within the guidelines defined in the help center. You should ask this question on the meta site where your concern originated." – ᔕᖺᘎᕊ, S.L. Barth, Wrzlprmft, Fish Below the Ice, gnat
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    FWIW I think you did the right thing merging the answers. Now lock it. – jcolebrand Jun 16 '11 at 20:25
  • 7
    I saw this discussion too late - I can see your point about the answers being too 'rant-y', and I would have happily edited them if I had known about your reservations. Joining them into one answer is a good idea, and I'll revisit the language. But the join just deleted 1200 reputation points from my account :O – Jens Roland Jun 19 '11 at 17:15
  • 7
    I'm sure you can't 'move' votes that were cast on one answer to another, but I don't really see how I can lose 1200 rep because of a merge. The answers are on-topic, clearly the most helpful answers for that question, and I actually took the time (about 6 hours worth if memory serves) to give a detailed answer to a difficult question. The upvotes were certainly legit, and the content is still there, so should I be losing 1K of my measly 7K reputation? – Jens Roland Jun 19 '11 at 17:49
  • @jens you had a lot of answer on old questions that are no longer suitable for Stack Overflow -- rant/opinion/debate/discussion type questions -- and those are slowly being removed from the site as well. You might be interested in this: blog.stackoverflow.com/2010/12/… – Jeff Atwood Jun 19 '11 at 21:24
  • 1
    Oh! I hadn't seen that post. That's a really great direction for the site actually. Might take a lot of moderation (and moving of threads?) but ultimately I think it's worth it. I'll be sad to see my SO rep go poof, but hopefully some of those threads will belong somewhere else. – Jens Roland Jun 20 '11 at 7:12
  • If you do decide to push this question away, Information Security will be glad to receive it :) – AviD Jun 21 '11 at 13:55
  • 4
    @Jens Time and time again, SO has demonstrated that they care not a whit about your rep. Small users like myself (<2500 - normal for users that don't answer C or Java) have woken up to adjustments downward often enough to begin resenting SO instead of loving it as we did when it began. – SamGoody Nov 7 '12 at 23:09

I'd say the answer content is fair. It isn't the best, but it's not terrible either, so I think it's worth preserving.

I think the following actions should be done:

  • Close the question, and place the "this is an old question" bit in to make it clear that it's a grandfathered question
  • Try to preserve the content
    • Ask the answerer to post it on a blog
    • Maybe we could post it on Meta? We've done that when OPs have asked for deleted questions to be posted, despite their questionable on-topicness for MSO.
    • Or some other solution—it's CC-BY-SA, so maybe someone else could preserve it on a blog?
  • When the content is preserved, delete the question

Just noticed this:

I see multiple, severe problems

Any specific examples? A quick skim didn't find anything outrageous, but I didn't read it through in detail.

  • For the CAPTCHAs are illegal, the answerer does back this up with a link. I'm not an attorney, and I'm fairly sure no country would enforce this, but it sounds to be one of those things that are technically illegal:

    CAPTCHA (Completely automated Turing Tests To Tell Humans and Computers Apart) are illegal in any jurisdiction that prohibits discrimination against disabled citizens.


  • 1
    I guess Google needs to shut down Recaptcha then... and if you are thinking "hmm, why haven't they?" then this should tell you why that advice is BS. Every answer is more of a rant than actual technical advice. – Jeff Atwood Jun 15 '11 at 6:44
  • 8
    @Jeff That was the last point in why one shouldn't CAPTCHAs for logins—it's not like that was the central argument there. Points #1, 2, 4 (on CAPTCHAs) seem fairly sound to me (I don't know enough about CAPTCHA-solving bots for simple CAPTCHAs to argue either way). And I personally don't find it too ranty. – waiwai933 Jun 15 '11 at 6:47
  • 4
    @Jeff, Recaptcha unlike 99% of CAPTCHA systems out there does at least allow blind people to get past - there are lots of legal issues that will hit someone on this at some point... – Ian Ringrose Jun 15 '11 at 8:35

Whilst I appreciate the time and effort put into the answers by Jens, the problem I have with these answers is that they read like opinion pieces rather than cold hard facts backed up by citations from trusted sources.

There is one answer that has a handful of links to OWASP, a couple of university papers and wikipedia under the title of "MUST-READ LINKS" but it doesn't make up for the severe lack of credible sources to be making all these assertions. Also who the hell is Charles Miller?

As to the other answers, the same problem applies, lots of links to blog posts and articles that I find are not what could be considered credible security sources.

It's not a question and answer post I would use as a trustworthy "Definitive Guide" or refer others to.

  • 2
    You don't know Charles Miller?! – Josh Caswell Jun 15 '11 at 8:25
  • @josh - honestly? never heard of him until today. I have found a wikipedia entry for him that doesn't really tell me much other than he won pwn2own, broke safari and some other Apple stuff. But that's the overall problem with the answers, I'm expected to trust Charles Miller without any explanation as to why. – Kev Jun 15 '11 at 8:40
  • 1
    No, sorry, it was just a joke. – Josh Caswell Jun 15 '11 at 17:47
  • @josh - ah...lol – Kev Jun 15 '11 at 18:00

TL;DR. But would have been very suitable as reference to close two other questions today.

The only thing that makes this question stand out is the attempt to have ordered answers. That's not the typical answer structure, especially next>> and <<prev links look odd. Not sure if editing can fix it; at the very least would require someone to sponsor a bounty to ignite some cleanup.

Given that we have far worse discussions on this topic in , there is however no question that it should be kept. (Also I'm generally against Wikipedia-esque deletionism.)

  • 6
    speaking as a web developer on a large site you may have heard of, I find that the answers there have severe technical problems, starting with "don't use captchas, which are illegal in many countries.." – Jeff Atwood Jun 15 '11 at 6:30
  • There are some other bemusing tidbits like that. And well, would be too late for any downvoting (much less so for CW posts). -- But what Gamecat said: The actual problem is the lack of a suitable migration target. I don't believe the topic is worthless in its entirety. – mario Jun 15 '11 at 6:36
  • @Jeff, I would bow to your technical expertise in this area. If there are a lot of problems, then it wouldn't make a good reference, certainly not one that SO would want pulling people in. – Lance Roberts Jun 15 '11 at 6:38
  • @lance I am considering ways to partially save it (largely by combining the 6 different "answers"), but it's so rant-y. – Jeff Atwood Jun 15 '11 at 6:42

It's not a usual Stack Overflow kind of question, and it really shows that the SO format doesn't work too well for that type of question, BUT I really like it. I'm just getting into Web Programming myself, and know that I'll want to read through the whole post eventually. I also think that it will draw a lot of users in, though I'm sure you have hard data on that one.

So I'd keep it.

I like the prev/next stuff in the one answer, and think that series of answers should all be linked like that, though it shows how ill it fits the format.


As the original author of the answer in question, I just wanted to give a quick update:

As of July 2015, the original answer has changed a lot. The contents have been updated and expanded on, the language has been cleaned up, and most of the opinionated paragraphs have been rewritten or removed entirely.

The answer now begins with a more cohesive and to-the-point description of the fundamental pattern of form authentication, lending a clearer context to the more 'deep-dive' points made in the subsequent 'parts'.

I think the changes over the past years have addressed most of the concerns raised here, and I am happy with it as a contribution to StackOverflow.


I think the contents is nice (probably great). But it's more like a blog post than a Q&A format. So it can probably migrated to somewhere else to keep the Stack Overflow format clean.

Maybe it's time to add a new branch to the Stack Overflow tree. The howto branch. Then we have a place to migrate this valuable contents to that does not fit exactly in the Q&A format.

  • 1
    +1 for "a new branch". Would be quite cool to find a way to take advantage of all the brainy-ness around here for creating long-winded but definitive writeups. – Josh Caswell Jun 15 '11 at 7:12

I don't really know but isn't there a suitable site that has a blog it could be transferred to?

It seems a lot of work went into it, and although I don't know the technicality of it's contents it would appear to be a good reference or stop given the amount of views.. the post content could be then deleted and/or become a reference link

I think the user would be fairly upset if it just went, perhaps suggest they copy the post to their own blog and link to that (or is that swearing ;))


@JeffAtwood: It seems your original merge of my answers now has you down as having 49% authorship of it.

The answer has earned 250 upvotes in the past week, and the rep is going to your account instead of mine. I don't care so much about the rep though, as I believe credit should go where credit is due, and it now looks like you wrote that answer.... which, based on your comments about the writing style, I think we both could do without.

  • 2
    Community Wiki posts don't generate any reputation. – Mat Nov 11 '12 at 10:34
  • 1
    Nobody is getting rep. It's a community wiki. – Mysticial Nov 11 '12 at 10:34
  • Hmm. I received rep for that answer up until 2 months ago, and I didn't see anything in the log about it being converted to community wiki at that time. But I see it now. – Jens Roland Nov 11 '12 at 14:04

Not the answer you're looking for? Browse other questions tagged .