Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sick of spending time on Auth, we built an open source 'Stripe for Auth'

news.ycombinator.com

Post reply on HN
Print view View original

271–280 of 347 posts

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#271

Post by advaitruia »

rboyd wrote: post #106
advaitruia wrote: post #13

Earlier quoted context omitted.

Keycloak is a worthy alternative, no doubt. There are a few reasons we built SuperTokens - despite knowing about Keycloak: We've taken a modular approach which is different from most. This enables you to only pick the features you want for your use case and not worry about unnecessarily complexity. We provide far more flexibility and options on the frontend as well KeyCloak is a small part of the Redhat (and even les…

Is SuperTokens multitenant capable? My understanding is that keycloak suffers in a multitenant enviroment with a sufficiently high number of tenants.

To an extent, yes: https://supertokens.io/docs/emailpassword/common-customizati...

Typical multi tenancy implies that the auth experience and data is isolated per tenant. However, often b2b companies simply want to provide an auth experience to their client within a specific subdomain. They do not mind the auth data be stored in the same db tables as other clients. If this is the use case, then we do support it. If you want strict isolation of auth per tenant, then you will have to deploy multiple instances of the SuperTokens core (as of today).

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#273

Post by hunter2_ »

RandallBrown wrote: post #263
dragonwriter wrote: post #240

Earlier quoted context omitted.

> I don't love this either, but it's basically the same inconvenience as having multi factor authentication turned on. MFA usually uses channels that are intended to be relative low latency (or that don't require realtime out-of-band transmission, like TOTP). Email, OTOH, isn't generally reliably low-latency

Is there a technical detail of email that I don't know about that makes it less low-latency than a text message? Email or text would work the same for this auth scheme anyway.

tangent: SMS doesn't have the security needed for most things. We can let it be a part of auth when combined with another factor, albeit begrudgingly.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#274

Post by DangitBobby »

honestduane wrote: post #270

Honestly, Auth0 is cancer for startups and artificially increases the cost of every user. I Really hate Auth0; you should, too.

The pricing model is completely unreasonable. I'll never use or recommend it to anyone.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#275

Post by pgt »

rkeene2 wrote: post #48
pgt wrote: post #4

Authentication is a solved problem; authorization is not. External authentication makes your system brittle, so I'm glad to see you can self-host SuperTokens for free. I've been working on Enterprise Access Control (EACL) in my spare time, an embedded Datalog-based library with a uniform declarative Clojure API that lets you write grant/deny ACL rules in the shape: Who, What, Why, When, Where & How that goes a little…

Cue Zed Shaw and "The ACL Is Dead"... I once worked on a project for flexible authorization called "SecureKit" which attempted to be a common criteria evaluated system for any kind of authorization. It quickly became apparent that it would pretty much have to be Turing complete to satisfy the general case. For example, some systems anyone can authenticate when a fire is occurring in some other areas, but normally onl…

Yes, this is what I realized too. It is why EACL is embedded in the application layer instead of trying to run in a layer above it. To do authorization properly, rules need to be embedded alongside the secured data and decision code needs to run next to application code.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#276

Post by advaitruia »

d33lio wrote: post #43
munchbunny wrote: post #22

Interesting idea! I did a quick look through your site and have a few issues: 1. What MFA methods do you support? TOTP? App based auth? U2F? FIDO2? (FIDO2 USB? BLE? Platform authenticators?) Smart cards (especially for enterprise)? Backup OTP's? New device detection? 2. Your docs mention not playing nice with password manager autofill by default. Are there plans to address this? 3. Password reset emails come from @su…

I second this! Please prioritize TOTP / U2F over social logins. I might be off base here, but does anyone really leverage social logins anymore? Seems like it's the worst case scenario for auth in the case that a customer can no longer access the associated social account? Basically in every case you'd have to provide an antiquated flow for them to "re" sign-up with an email. I'm genuinely curious of the value add he…

From our conversations with developers, a surprisingly large number of their users use social login - even when the site provides alternatives. Many have categorically said that they cant use any solution without social login. And we've seen this generally be true across many use cases

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#277

Post by rishabhpoddar »

WatchDog wrote: post #267

Simple, JWT, pick one. Really don't understand the obsession with JWT, especially if you don't need SSO. Only real advantage of JWT, vs the tried and true random session_id+database approach, is that you don't need the DB. What useful web application needs auth, and doesn't already have a DB?

This is a debatable topic. We wrote a blog post about this as well: https://supertokens.io/blog/are-you-using-jwts-for-user-sess...

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#278

Post by eps »

movedx wrote: post #212
nickthemagicman wrote: post #202

Earlier quoted context omitted.

This is a really cool idea. So they basically go to their email and verify and it stores a token in their cookies?

Exactly. They login by just providing their email. It sens a link with a unique code in it. This code is checked against the DB and if it's correct, they get a cookie (the digital kind ;])

Beware of setups that verify (i.e. visit) all links in an email upon receiving one. This completely breaks one-time use login links.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#279

Post by Doctor_Fegg »

movedx wrote: post #213
gfxgirl wrote: post #209

Earlier quoted context omitted.

I know I'm the exception but as a privacy oriented user I hate this. There are services that try to track me across the net when I'm logged in so I never log into them except in a private window. This works great when my browser has the name/password saved because I go to the site and its one click to login. It sucks though when it's email login. I now have to click "login", wait 10 second to 3 minutes for the email…

You're not my target audience and you have an esoteric approach to privacy.

Using private browsing to minimise tracking is absolutely not esoteric.

Re: Sick of spending time on Auth, we built an open source 'Stripe for Auth'

#280

Post by flemhans »

cstejerean wrote: post #222
OJFord wrote: post #215

Earlier quoted context omitted.

FWIW, I hate this about the couple of apps I use that do this (with no other option, e.g. Notion added a password option). And not for privacy concerns, as a sibling thread is discussing, but simply because I find it considerably less convenient than a password, as most things use, and as I'm set up to conveniently use and expect. It's especially annoying when setting up a new device - oh right yes, obviously I need…

For anything I use with any kind of regularity I’d hate it. I already have this problem with services that decide they really need to send me some code by email because they don’t recognize my device (because it’s been more than 30 days and Safari killed their cookies). And then every once in a while the email doesn’t show up for 45 minutes for some reason, leaving me with no recourse. But for certain things that I n…

I access almost all services in private tabs, i.e. cookies are not persisted, and let my password manager do the login.
Post reply on HN