User authentication: customize verification email?

[mark_talluto]

In the CanelaDB, is the password actually encrypted or is the UUID assigned just the reference to the password stored elsewhere?
If the password is actually encrypted rather then just referenced, the need for changing passwords for just GP becomes unnecessary, because CanelaDB cis the only way to read it. Am I correct with this assumption?

Your user's password is not stored locally. The hash of their password is stored in the cloud as part of a record. That cloud record is stored encrypted to disk.

The next part is a bit long but important. Get a cup of coffee and continue on if you are interested.

-When the client is online
When you call cdb_auth(), we are checking with the stored data on the cloud to make sure the email and password combination match. A nonse value is sent back to the client. The auth routine continues to protect you from middle-man attacks by sending the secret nonse value back to the cloud. The cloud verifies that you sent the proper value and then returns with a thumbs up along with an API access key to allow the user to continue with your app. The cloud network, including all the data instances, user instances, and other related access points are updated with the temporary API access key. All subsequent calls will pass the API access key with every call so the various parts of the cloud know you have been authenticated. The instances will verify your API key for every call. Should it fail the match, your access to the cloud will cease and return an error that you can use to return the user to the login screen.

-When the client is offline
When you call cdb_auth(), the routine attempts to decrypt the local data which has been encrypted using a hash of the email and password. If the routine is successful, we give your app the thumbs up for local auth.

Should the user go online after local authentication, the cloud calls will require cloud authentication. You will need to have the user authenticate as explained above to gain access to the cloud data.

Thus, when your user sign's into your app, the password is only in the brain of the user. This makes things very secure as far as the tech is concerned. People are the weak point in the process as they do things that can make a secure process insecure. For example, they put passwords in a written form that may not be secure. Taking all that aside, the method we have chosen is pretty good. The next step would be to offer 2FA (two-factor authentication) for authentication as an option. We use 2FA when you do a forgot password as one example of 2FA already being in CanelaDB and LiveCloud.

I think it is important everyone understands how this works so you can decisions or at least have an opinion on the security provided in CanelaDB and LiveCloud.