111–120 of 234 posts
I'm even hesitant to trust Auth0 for this, why would I trust a new company?
This is my question as well. It's an honest question and hopefully someone can educate me. Why would anyone trust a third party with what is the most important asset, their users? Thank you in advance.
Hi HN - We couldn't be more excited to launch Clerk and help developers solve all of user management. It's been quite a journey to reach this point, with over a year of iteration on the developer experience before we found something developers love. Using Clerk will enable you to spend more time on your application, and less time worrying about the ever-growing list of user management concerns. Our team is listening…
So is it the same as Login with Facebook or Google? Google/Facebook/Clerk manages the GDPR (do you? that is 300% added value for a business) and the app can focus on the data? Is your main added value that you are not Facebook/Google?
I'd be _very_ hesitant to use this without some very strong guarantees that legal won't come breathing down my neck because I can't point them to a contractual guarantee that we will be complying with those (and similar rules from other jurisdictions).
I lose enough sleep worrying about PII that I store in databases I manage. Farming that responsibility out to a 3rd party does not fill me with joy, it raises instead lovecraftian levels of horror about what I'd tell a judge about how I ensured an EU citizen's rights to have their data expunged from my auth/userprofle system...
Earlier quoted context omitted.
For me to take a company seriously MFA must be in all their plans. MFA is not an enterprise hook for upsell, it is a fundamental requirement for any online service these days.
Agreed, MFA is so important that a company should be willing to pay for it.
Earlier quoted context omitted.
SOC 2?
Not yet. We plan to pursue SOC 2 as we build out Organizations, since it's a clear requirement in a B2B context.
Here's a good reference: https://trust.okta.com
Earlier quoted context omitted.
For me to take a company seriously MFA must be in all their plans. MFA is not an enterprise hook for upsell, it is a fundamental requirement for any online service these days.
Agreed, MFA is so important that a company should be willing to pay for it.
Not offering MFA on the free tier tells me you're more interested in making money than in security.
There are plenty of other features that an enterprise will pay for.
I'm probably not the main audience for this, but if you mention security as a top-level feature it might be good to fix these: https://securityheaders.com/?q=https%3A%2F%2Fclerk.dev https://securityheaders.com/?q=https%3A%2F%2Fdashboard.clerk... For me it is also a red flag to include third party CDN JS (especially without SRI) on security critical applications (like the login for the dashboard and customer logins do…
And agreed on the CDN JS. We'll move these assets to the customer's domain.
Earlier quoted context omitted.
or, you could just do passwordless email auth and not have any security issues whatsoever.
“Not have any security issues whatsoever” is literally impossible. Passwordless auth is the security equivalent of putting all your eggs in one basket. If someone hacks a users email account, now they have access to your service too. Now I’m pissed that you didn’t let me enable 2fa to prevent that or have multiple secure passwords to isolate the hack to my email. You could have just shelled out the 10 cents it would…
you don't have to use your real email for everything, even google has forwarding addresses.
and apple has private/forwarding emails as well, so this is a moot point.
Earlier quoted context omitted.
“Not have any security issues whatsoever” is literally impossible. Passwordless auth is the security equivalent of putting all your eggs in one basket. If someone hacks a users email account, now they have access to your service too. Now I’m pissed that you didn’t let me enable 2fa to prevent that or have multiple secure passwords to isolate the hack to my email. You could have just shelled out the 10 cents it would…
just use a fake email? you don't have to use your real email for everything, even google has forwarding addresses. and apple has private/forwarding emails as well, so this is a moot point.