Viewing profile — mcstempel

There are options beyond auth walls for detecting/enforcing behavior as well since these scrapers have very recognizable device signatures: https://stytch.com/blog/detecting-ai-age…

thanks for sharing!

wow, this is wonderfully made

Ah, this is great feedback -- I don't think we do enough to articulate how much we're doing beyond that simplified explanation of device fingerprinting on those docs. I'll get that…

CAPTCHAs have been ineffective as a true "bot detection" technique for a while as tools like anti-captcha.com allow for outsourcing it to real humans. BUT they have been successful…

You read our mind! https://stytch.com/blog/the-age-of-agent-experience/ Very much agreed that's the long-term goal, but I think we'll live in a world where most apps don't support …

LinkedIn always hits me with those frustrating custom CAPTCHAs where you have to rotate the shape 65 degrees -- they've taken a pretty blunt, high-friction approach to bot detectio…

Hey there, I'm the author of the post. I'm actually pretty sympathetic to your viewpoint, and I wanted to clarify my stance. I actually spent years working at a "good bot" company …

We built Stytch's B2B SaaS solution with this specific shortcoming in mind -- most other solutions aren't actually built with an organization-first data model (they're user-first l…

You can now set up passkeys on your personal gmail, which I've found to be particularly nice for times when I'm trying to log in via webview

Yeah, +1. Even vanilla puppeteer is pretty successful against Cloudflare

To your point, the market will decide, but I'm hopeful passkeys will ultimately be one of the key solutions here. Already seeing a lot more app adoption (e.g. Shopify, Google, Docu…

Co-founder of Stytch ( http://stytch.com/ ) here -- would love to see if you think we're a fit. We have a generous free tier and we're more reasonably priced that tools like Auth0,…

TL;DR as a dev tools company, we took a lot of inspiration from how Stripe built their product, including their very simple approach to self-serve pricing. However, we found there …

> this worked for a little bit longer, but he proceeded to get on a VPN, and then another when i blocked that IP, then another when i blocked that IP, etc, etc. Beyond VPNs, I've e…

Also, a tip for anyone that feels like the low hanging fruit prevention methods aren't working (e.g. CAPTCHA, rate limits, etc.) Consider installing a device fingerprinting system …

I find it particularly frustrating that they force you to upgrade to Verify to solve the problem unless you want to build out a lot of your own internal risk detection (which we en…

Ah yes, good call out! Didn't mean to exclude Google's contributions to this step forward in auth. I was super excited to read those additional details in Google announcement earli…

As usual - it depends. There have been two main problems with WebAuthn as a primary factor. The first is that the UX experience of WebAuthn as a primary factor - either for "passwo…

No problem – I’m happy to engage in good-faith discussions like this one when there are valid nuances to explore. One callout I’d like to make is that there are two kinds of SDKs. …

Yes, Firebase also stores refresh tokens client-side [1]. The trade-off that both Firebase and Stytch are managing when we follow this pattern is the following: - You can provide a…