10 Popular Security Practices That Do More Harm Than Good

These were good security practices 10 years ago. Attackers evolved. Our code did not.

I am a software developer and security enthusiast. I have built authentication and payment systems for banks. Getting security wrong there gets expensive fast.

I have also sat on the other side of the table, reviewing other teams’ code during security audits.

Both roles taught me the same lesson. Most insecure code does not come from careless developers.

It comes from careful developers following advice that used to be correct.

I have also made some of the security mistakes in my code earlier. And I have learned my lesson the hard way.

Non-medium members click here to read for free.

Over years of auditing code and writing it, I have seen practices that sound right but are wrong.

Here are ten of those, and what I use now instead.

1. Expiring Passwords Every 90 Days

You wrote this check in your code. You own passwordChangedAt and the redirect that fires once 90 days pass.