What are the (practical) dangers of writing your own login method?

Question

I have always been told that writing your own login method (e.g. validate user given the username and password) is bad practice, and that one should reuse existing libraries for that. I have always believed that, but I am looking for practical threats in such a scenario (C#). The practical case I am looking into is customizing a login method to include the validation of a Captcha. I haven't found any existing library to do that inside the authentication logic.

One of the implications of my custom implementation is that the validation method does not return a bool, but another type. May this pose a danger?

Answer 1

The danger is expressed in Schneier's law:

any person can invent a security system so clever that he or she can't imagine a way of breaking it.

The only way anyone knows to test if any given system is secure is to have lots and lots of clever people try to break it over a long period of time. You won't have that with a system you rolled yourself.

Answer 2

...but I am looking for practical threats in such a scenario (C#)

There are a huge number of ways that you could introduce a vulnerability by rolling your own login. A few that come to mind:

User enumeration - I've seen people who give descriptive messages when a login fails ("user does not exist", "user exists, but password was incorrect", etc.) instead of a generic "login failed" message.

Insufficient lockout policy - This would allow a malicious user to bruteforce username/passwords. This is extra dangerous if you have the User enumeration vulnerability mentioned above.

Not performing login action over HTTPS - Could allow for a man in the middle attack when someone logs in.

As I mentioned there are a number of other potential vulnerabilities that you should watch out for (SQLi, XSS, the list goes on), but the three above are common ones that I've seen in "roll your own" logins.

Answer 3

I taught to never "roll your own" in situations where there is something already written to do something similar. If I were you I would try to find something thats proven to work and try to build around or on top of that.