I can’t think of a more dangerous way to tie your revenue to someone else’s product. And what if you want to drop this vendor?
Sorry, no more authentication until we can get you on a quick call to talk about your needs.
Show HN: Clerk – all of user management as-a-service, not just authentication
181–190 of 234 posts
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#182As someone who uses Django which has user management out of the box, why would I use a service like this?
I think Django has by far the best story here, so much built in or activated with simple plugins. It took us an hour to add 2FA. On the other hand, looking at node.js it's really a dumpster fire[1]. Even when using passport, you are still back to writing the code to compare passwords at which point so much can go wrong. So there's a lot of scope for hosted services. This of course compounds the problem because those…
I've been building a Next.js app with a Django backend using django-rest-framework and dj-rest-auth. dj-rest-auth[1] handles auth and registration out of the box and takes no time to get up and running.
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#183Earlier quoted context omitted.
Another question, I don't see any mention of security. You are in complete control of our users/profiles and their login credentials and there is zero mention of how secure that data is.
Hi dubcanada, Thanks for your questions! It's good feedback that there's no security documentation up yet. We have a lot more content coming live in the next few weeks - but let me try to hit some of the most important points: * Session management is handled with secure, httpOnly cookies. We have you set a CNAME in production so we can set cookies in a first-party context (SameSite=Lax). * Cookies are scoped only to…
Bcrypt should be replaced by Argon2
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#184Does anyone know how long this service has been around? Only worry is that this service goes under in year and having then to migrate to cognito or okta.
We've been quietly building for awhile, and today is our first public announcement. We are well funded, and don't plan on going anywhere, especially in the next year. This product is something I've personally wanted for some time, so will self fund and bootstrap the thing if needed. I definitely understand the hesitation though, and hopefully we can build trust over time.
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#185I'm probably not the main audience for this, but if you mention security as a top-level feature it might be good to fix these: https://securityheaders.com/?q=https%3A%2F%2Fclerk.dev https://securityheaders.com/?q=https%3A%2F%2Fdashboard.clerk... For me it is also a red flag to include third party CDN JS (especially without SRI) on security critical applications (like the login for the dashboard and customer logins do…
> For me it is also a red flag to include third party CDN JS
Why anyone would use third party js for anything other than dev work is beyond me. Are people really building websites that can serve html, images, and css, but not js?
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#186Earlier quoted context omitted.
Braden, one of the founders, I gave you an upvote! GDPR is definitely at the top of our mind. We would love to make it so developers don't need to think about, or make it easy to think about, GDPR and CCPA, and any future regulations that come up.
The question becomes; where is your company incorporated, where are your servers located. I was looking around on your website and it's very light on such details.
We definitely have a lot of work to do on content and more detailed information. Turns out high quality writing takes a lot of time and effort!
Right now we're hosted on GCP in us-central. We will need to be more distributed as we start to tackle GDPR et al., making sure data is hosted in the correct location.
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#187happy to see this on the front page, congrats colin and braden! I signed up for a dev account last month, definitely will be using this for projects in the future. - stefan
Hey stefan, great to hear! let's catch up soon
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#188So, first, congrats on launching your product. :) Personally, I don't have a need for it, and if I did, I'd be very reluctant to use a proprietary service, but I'm sure there are companies out there who will be happy to use you. Good luck! ------------ That said, maybe the HN community can answer something I've wondered about... Why isn't there an Open Source, standardized, self-hosted, version of this kind of servic…
I haven't tried it but https://www.keycloak.org/ (by redhat) seems close to what you describe.
I have found confusing then support for multi-tenants and your own auth tables (ie: put the auth tables in the schema of each tenant?) across the board. Exist one project where I can do both?
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#189I can’t think of a more dangerous way to tie your revenue to someone else’s product. And what if you want to drop this vendor?
I am actually astounded by the number of people on here who think this is a great product. I mean as a product it might indeed be quite good, but it also comes with the huge risk of you funneling your users into a third party company, who can then hold that as a knife to your neck (intentionally or unintentionally).
Sorry but the greatest user management experience in the world is not going to make me use this. Maybe, if there is some kind of mirroring back of all user data to some database I control, I might consider it.
But even so, I don't think it's a great idea to give away all my user info to a third company. I'm sure it's covered as necessary for functionality,but what happens if tomorrow Clerk gets bought out by Facebook and they decide the database of my users is now theirs to target for advertising? Especially when the privacy policy a actually says they will collect and share personal information with their affiliates and subsidiaries.
Nope, sorry not touching this with a 100foot pole. And I will go further and not use any company that uses this for their user management needs.
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#190Earlier quoted context omitted.
This is my question as well. It's an honest question and hopefully someone can educate me. Why would anyone trust a third party with what is the most important asset, their users? Thank you in advance.
I can answer with the opposite question. Why would you trust your homemade solution instead of heavily invested experts? Auth0 (and Okta and a thousand others) do nothing but auth and customer management and do it at 1000X the scale as most enterprises. They do it way better than your IT team could possibly do it. And support every cutting edge feature and potential use case. You can also get them to absorb indemnity…
Have you seen the privacy policy for this service? Clearly not GDPR compatible. Simply using this means you cannot service the EU.
Also, if your issue is that owning your user passwords is difficult, then I'm sorry that's just the nature of the problem. It doesn't get any easier by offloading the problem to a third party. Bcrypting passwords is not rocket science anyway. MFA libraries exist for pretty much any server library you use.
Sure a company dedicated to doing user management will definitely do a better job than you, but only if your needs align with those of the majority of its users. The minute you want something custom,and trust me you will you're back to doing user management yourself. Only now you have a giant opaque blackbox to deal with.
Also, tomorrow if Google buys the company,I'll have 20 hours of notice to integrate my own user management before they shut it down. If Facebook buys it, they'll use my user data for targeting their advertising. Either way, I'm in deep trouble (If I care about my users, which I think most people will).
Even ignoring these, the simple fact is that by the very nature of the company, it is a much bigger target for people trying to break into and steal user information,than my little saas could ever be. I'd wager for most people using such services they'd be more likely to get hacked as collateral damage rather than being targeted.