Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

github.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

#11

Post by hperl »

pzmarzly wrote: post #3

> Two-step registration is a significantly improved sign up flow It is usually worse for users using a password manager, since some of them will not be able to detect/autofill the password field on the second page. But I haven't checked, maybe Kratos UI is supported by all major password managers and this is not an issue here. Since the parameter is called "enable_legacy_flow", does it mean it will be removed in futu…

Hi, thanks for the feedback. I've been building this at Ory.

> It is usually worse for users using a password manager, since some of them will not be able to detect/autofill the password field on the second page. But I haven't checked, maybe Kratos UI is supported by all major password managers and this is not an issue here.

The two-step flow is currently only implemented for registration, so autofill should not be a concern. However, we surely want to inform the password manager to store the correct password after registration.

Do you think https://developer.mozilla.org/en-US/docs/Web/API/Credentials... is the correct way to inform a password manager?

> Since the parameter is called "enable_legacy_flow", does it mean it will be removed in future releases?

In general we perceive the two-step registration as an UX improvement when you have multiple credential strategies, which previously would generate a long registration form with repeated fields. However, we have no plan to remove the config value in the forseeable future.

Re: Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

#13

Post by hypeatei »

I've said it before but I really cannot believe Auth0 doesn't offer TOTP 2FA in their "essentials" tier. Ory Kratos seems to offer it at their lowest tiers which is good.

It costs nothing (unlike SMS) so I'm not sure why Auth0 wants to charge $240+/month just to get basic 2FA.

Re: Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

#15

Post by ssahoo »

I have recently added passkey support for a few apps just to support a newer Auth standard. All i can tell, i have been very unimpressed.

LOGIN UX has become very confusing. Users have been vendor locked down. Since windows and mac and linux users have to deal with multiple key management which isn't ideal.

In my opinion, it isn't any more secure over mfa.

Re: Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

#16

Post by EtienneK »

ssahoo wrote: post #15

I have recently added passkey support for a few apps just to support a newer Auth standard. All i can tell, i have been very unimpressed. LOGIN UX has become very confusing. Users have been vendor locked down. Since windows and mac and linux users have to deal with multiple key management which isn't ideal. In my opinion, it isn't any more secure over mfa.

It’s phishing resistant; thus making it more secure than all other current popular MFA methods.

Re: Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

#17

Post by toomuchtodo »

hypeatei wrote: post #13

I've said it before but I really cannot believe Auth0 doesn't offer TOTP 2FA in their "essentials" tier. Ory Kratos seems to offer it at their lowest tiers which is good. It costs nothing (unlike SMS) so I'm not sure why Auth0 wants to charge $240+/month just to get basic 2FA.

Because they can, like the SSO tax.

Re: Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

#18

Post by tracker1 »

pzmarzly wrote: post #3

> Two-step registration is a significantly improved sign up flow It is usually worse for users using a password manager, since some of them will not be able to detect/autofill the password field on the second page. But I haven't checked, maybe Kratos UI is supported by all major password managers and this is not an issue here. Since the parameter is called "enable_legacy_flow", does it mean it will be removed in futu…

I've found that having the "username" visible along with a hidden "password" field, then keeping that after confirming the user is a password based user on the password entry screen is generally helpful for use with a password manager.

    [Username] Visible
    [Password] Hidden
    [Next] Button Clicked
    |
    V
    Server checks username and user type (password case)
    |
    V
    [Username] Read Only
    [Password] Visible, with any previously submitted value
    [Login]
Similarly for account registration, with a hidden username field and a visible password field if separating the password and account initial entry.

Just my own experience with a lot of experiments on implementing an authentication system and supporting a password manager for self-serving purposes.

Re: Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

#19

Post by Fire-Dragon-DoL »

hperl wrote: post #11
pzmarzly wrote: post #3

> Two-step registration is a significantly improved sign up flow It is usually worse for users using a password manager, since some of them will not be able to detect/autofill the password field on the second page. But I haven't checked, maybe Kratos UI is supported by all major password managers and this is not an issue here. Since the parameter is called "enable_legacy_flow", does it mean it will be removed in futu…

Hi, thanks for the feedback. I've been building this at Ory. > It is usually worse for users using a password manager, since some of them will not be able to detect/autofill the password field on the second page. But I haven't checked, maybe Kratos UI is supported by all major password managers and this is not an issue here. The two-step flow is currently only implemented for registration, so autofill should not be a…

Password managers autofill during signup too, both username and password and when they do, they detect it and ask if you want to save the credentials, including the random generated password

Re: Show HN: OSS Auth0 Alternative Ory Kratos Now with Full PassKey Support

#20

Post by Fire-Dragon-DoL »

EtienneK wrote: post #16
ssahoo wrote: post #15

I have recently added passkey support for a few apps just to support a newer Auth standard. All i can tell, i have been very unimpressed. LOGIN UX has become very confusing. Users have been vendor locked down. Since windows and mac and linux users have to deal with multiple key management which isn't ideal. In my opinion, it isn't any more secure over mfa.

It’s phishing resistant; thus making it more secure than all other current popular MFA methods.

It's not ban resistant from a large org too. That threat factor is all new and should be accounted for.
Post reply on HN