Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sick of spending time on Auth, we built an open source 'Stripe for Auth'

news.ycombinator.com

Post reply on HN
Print view View original

211–220 of 347 posts

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#211

Post by NoodleIncident »

gfxgirl wrote: post #209
movedx wrote: post #188

For my little web app I just went with passwordless logins and did the "magic token sent to the inbox" thing. I no longer have to deal with passwords at all; a security breach is (mostly) useless in terms of mining creds; and all of the password handling workflows are now the email provider's problem. If someone loses access to an email account then I can use manual processes to verify the person and change the email…

I know I'm the exception but as a privacy oriented user I hate this. There are services that try to track me across the net when I'm logged in so I never log into them except in a private window. This works great when my browser has the name/password saved because I go to the site and its one click to login. It sucks though when it's email login. I now have to click "login", wait 10 second to 3 minutes for the email…

Would something like Firefox's containers(?) help you for these sites? There's a way to leave a single tab signed in without having it leak the fact that you're logged in to your other browser tabs, rather than logging in each time you use the site in a new private session. It's even possible to log in to the same site on multiple accounts with this feature.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#212

Post by movedx »

nickthemagicman wrote: post #202
movedx wrote: post #188

For my little web app I just went with passwordless logins and did the "magic token sent to the inbox" thing. I no longer have to deal with passwords at all; a security breach is (mostly) useless in terms of mining creds; and all of the password handling workflows are now the email provider's problem. If someone loses access to an email account then I can use manual processes to verify the person and change the email…

This is a really cool idea. So they basically go to their email and verify and it stores a token in their cookies?

Exactly.

They login by just providing their email. It sens a link with a unique code in it. This code is checked against the DB and if it's correct, they get a cookie (the digital kind ;])

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#213

Post by movedx »

gfxgirl wrote: post #209
movedx wrote: post #188

For my little web app I just went with passwordless logins and did the "magic token sent to the inbox" thing. I no longer have to deal with passwords at all; a security breach is (mostly) useless in terms of mining creds; and all of the password handling workflows are now the email provider's problem. If someone loses access to an email account then I can use manual processes to verify the person and change the email…

I know I'm the exception but as a privacy oriented user I hate this. There are services that try to track me across the net when I'm logged in so I never log into them except in a private window. This works great when my browser has the name/password saved because I go to the site and its one click to login. It sucks though when it's email login. I now have to click "login", wait 10 second to 3 minutes for the email…

You're not my target audience and you have an esoteric approach to privacy.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#214

Post by colesantiago »

gfxgirl wrote: post #209
movedx wrote: post #188

For my little web app I just went with passwordless logins and did the "magic token sent to the inbox" thing. I no longer have to deal with passwords at all; a security breach is (mostly) useless in terms of mining creds; and all of the password handling workflows are now the email provider's problem. If someone loses access to an email account then I can use manual processes to verify the person and change the email…

I know I'm the exception but as a privacy oriented user I hate this. There are services that try to track me across the net when I'm logged in so I never log into them except in a private window. This works great when my browser has the name/password saved because I go to the site and its one click to login. It sucks though when it's email login. I now have to click "login", wait 10 second to 3 minutes for the email…

> There are services that try to track me across the net when I'm logged in so I never log into them except in a private window.

I'm sure you can have a browser extension to block cookies and other tracking information on these sites.

I use Brave with maximum security and privacy settings with a VPN in addition to using Tor and haven't had any issues.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#215

Post by OJFord »

movedx wrote: post #188

For my little web app I just went with passwordless logins and did the "magic token sent to the inbox" thing. I no longer have to deal with passwords at all; a security breach is (mostly) useless in terms of mining creds; and all of the password handling workflows are now the email provider's problem. If someone loses access to an email account then I can use manual processes to verify the person and change the email…

FWIW, I hate this about the couple of apps I use that do this (with no other option, e.g. Notion added a password option).

And not for privacy concerns, as a sibling thread is discussing, but simply because I find it considerably less convenient than a password, as most things use, and as I'm set up to conveniently use and expect.

It's especially annoying when setting up a new device - oh right yes, obviously I need to set up my email app before this one...

And what if I don't have or want or can't currently for whatever reason receive email on that device? Now I'm trying to get it there by some other means, only to find it times out in the process.

(This is all happened to me, and enough that I'm ranting about it...)

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#216

Post by codemac »

movedx wrote: post #213
gfxgirl wrote: post #209

Earlier quoted context omitted.

I know I'm the exception but as a privacy oriented user I hate this. There are services that try to track me across the net when I'm logged in so I never log into them except in a private window. This works great when my browser has the name/password saved because I go to the site and its one click to login. It sucks though when it's email login. I now have to click "login", wait 10 second to 3 minutes for the email…

You're not my target audience and you have an esoteric approach to privacy.

Most of my friends/family who use work laptops/computer do the same thing - they log in via a private browser so they don't get work credentials mixed with personal credentials.

I think firefox containers are a great way to handle this, and a lot of folks don't know how to use chrome or other browsers with multiple identities.

Maybe look past that this user is doing it for privacy.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#217

Post by galaxyLogic »

corytheboyd wrote: post #69

I know most people are not like this, but I don’t mind setting up auth “over and over” It’s always a chance to read about what’s changed in the technologies/ideas you usually lean on for it. Apply that simplification that you wish you could have for your already launched application. Maybe you have a need to make your auth slightly more proprietary. If you churn out applications all the time yeah I get why this could…

It's fine if you have the sponsor to pay for your time to deeply understand all the security protocols required and to keep up-to-date with those as well as their different implementations.

But complexity is the worst enemy of security because it easily creates loopholes in security. I think anything that can be done to simplify security will exponentially improve security.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#218

Post by anonytrary »

leesalminen wrote: post #155
anonytrary wrote: post #111

Earlier quoted context omitted.

Yeah I don't mind setting up auth. It takes like a week at most for your MVP.

I’m building a MVP to show off and validate some ideas. I’m using Firebase and set up auth with my react app in about 10 minutes. I’d never spend a week on auth for a MVP.

I was talking about rolling you own email/password auth from scratch. I keep hearing about Firebase and how easy it is. Is that like AWS Cognito? Does it have custom branding or is it a drop-in form? Can it be hooked to your own SQL database?

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#219

Post by colesantiago »

d33lio wrote: post #43
munchbunny wrote: post #22

Interesting idea! I did a quick look through your site and have a few issues: 1. What MFA methods do you support? TOTP? App based auth? U2F? FIDO2? (FIDO2 USB? BLE? Platform authenticators?) Smart cards (especially for enterprise)? Backup OTP's? New device detection? 2. Your docs mention not playing nice with password manager autofill by default. Are there plans to address this? 3. Password reset emails come from @su…

I second this! Please prioritize TOTP / U2F over social logins. I might be off base here, but does anyone really leverage social logins anymore? Seems like it's the worst case scenario for auth in the case that a customer can no longer access the associated social account? Basically in every case you'd have to provide an antiquated flow for them to "re" sign-up with an email. I'm genuinely curious of the value add he…

> I might be off base here, but does anyone really leverage social logins anymore?

I'm sure there are on tiktok and other popular social apps.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#220

Post by skinnymuch »

movedx wrote: post #188

For my little web app I just went with passwordless logins and did the "magic token sent to the inbox" thing. I no longer have to deal with passwords at all; a security breach is (mostly) useless in terms of mining creds; and all of the password handling workflows are now the email provider's problem. If someone loses access to an email account then I can use manual processes to verify the person and change the email…

I am not too privacy oriented like another post. I just don’t like having to go to my email to log in. It’s a hassle vs my saved password being auto filled or using an Oauth login. But Most other people seem to shrug it off and do it. So seems like it’ll keep becoming more common.
Post reply on HN