Two questions: 1. Why use this over AWS Cognito? 2. Any intention to manage authorization as well?
Have you used Cognito?
It sucks.
Show HN: Clerk – all of user management as-a-service, not just authentication
151–160 of 234 posts
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#152The pricing model has me confused: 1) Pricing is free up to 5,000 MAU 2) But the next pricing grade starts at 1,000 MAU for $49/mo + $0.05/MAU additional so if you have 5,001 MAU you take a big leap from $0 to $249/mo Is there a reason for that huge bump? Why doesn't the first pay tier start at 5,000 MAU? And how is MAU even calculated? Like, aren't all users in the system active users? Or are you able to have a bunc…
Hey all - looks like there's a lot of confusion on the pricing model here. That's our fault, sorry! The free plan does not include 2-step verification, and that was the reason for the increase in the paid plan. We'd love some feedback on how you'd like to see the free plan constructed. What would be most helpful for getting you started with Clerk?
If you are going to offer MFA, it needs to be standard. How would you feel if seatbelts in cars or life jackets on boats were a paid feature? What if your bank charged extra for declining suspicious transactions?
Not the type of behavior you'd expect to see from the company you're handing all your user account data over to.
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#153As someone who uses Django which has user management out of the box, why would I use a service like this?
Common use case is when you multiple apps that all require the same auth infrastructure. IE a suite of apps for a business.
Literally just launching this for our site today. A bunch of boring Django views, a couple React Node apps for crazy fontend stuff, and a PyData ~flask app for backend. Django gives accounts + login screens + JWT/CSRF APIs, and the JS/PyData stuff just pass around CSRF/JWTs as usual. Reverse proxy does extra stuff, but not essential for security.
I would love to see allauth extended with some sort of React toolkit so we could do SPA logins without refresh. That seems like a much smaller lift..
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#154I'm probably not the main audience for this, but if you mention security as a top-level feature it might be good to fix these: https://securityheaders.com/?q=https%3A%2F%2Fclerk.dev https://securityheaders.com/?q=https%3A%2F%2Fdashboard.clerk... For me it is also a red flag to include third party CDN JS (especially without SRI) on security critical applications (like the login for the dashboard and customer logins do…
Thank you for calling out the headers. We'll work to resolve right away. And agreed on the CDN JS. We'll move these assets to the customer's domain.
It’s a great idea, but your company is going to be a serious target. You not only will have the ability to control authN, but you’ll own authR also if you’re managing users and groups. You’ll also own all the conference rooms, printers, servers, etc., since you’ll be hosting Active Directory for the Windows folk... at least that’s how I’d understand user management for auth.
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#155Earlier quoted context omitted.
Thank you for calling out the headers. We'll work to resolve right away. And agreed on the CDN JS. We'll move these assets to the customer's domain.
It’s a great idea, but your company is going to be a serious target. You not only will have the ability to control authN, but you’ll own authR also if you’re managing users and groups. You’ll also own all the conference rooms, printers, servers, etc., since you’ll be hosting Active Directory for the Windows folk... at least that’s how I’d understand user management for auth.
Is authR another way to say authZ? I've never heard of authR and a quick google seems to mostly show a cloudflare project and stuff related to the term "author".
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#156I can’t think of a more dangerous way to tie your revenue to someone else’s product.
And what if you want to drop this vendor?
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#157Hi HN - We couldn't be more excited to launch Clerk and help developers solve all of user management. It's been quite a journey to reach this point, with over a year of iteration on the developer experience before we found something developers love. Using Clerk will enable you to spend more time on your application, and less time worrying about the ever-growing list of user management concerns. Our team is listening…
How close are you to adding billing to this? And do you have a public road map anywhere?
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#158I'm the founder of WorkOS ( https://news.ycombinator.com/item?id=22607402 ) which is sort of close to this so wanted to share a thought or two. WorkOS has taken the alternative design of ONLY doing authentication and explicitly not user management. This is a subtle but I think super important distinction so figured it could be useful to share why in this thread, especially for developers looking at auth solutions and…
Also colinclerk are you Colin Sidoti? If so I was a few years ahead of you at MIT and I think we totally we met a few times around when I was graduating. Small world! :D
Hey Grinich! Yup, that's me :) Small world indeed.
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#159Earlier quoted context omitted.
You’ve gone off on a personal tangent about how I as a user can increase my security. The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. An individual can mitigate them, but they still exist
> The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple. So are you saying I can be hacked through this way, please provide evidence of this happening in a real world passwordless scenario. > An individual can mitigate them, but they st…
> But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple.
I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues. Not every user is going to do that and theyre gonna blame you when they get hacked.
> Again, I would be more convinced of real world evidence and statistics rather than theorising.
You first. You made the initial claim that passwordless login has no security issues. Systems should be assumed insecure unless proven otherwise.
Re: Show HN: Clerk – all of user management as-a-service, not just authentication
#160So, first, congrats on launching your product. :) Personally, I don't have a need for it, and if I did, I'd be very reluctant to use a proprietary service, but I'm sure there are companies out there who will be happy to use you. Good luck! ------------ That said, maybe the HN community can answer something I've wondered about... Why isn't there an Open Source, standardized, self-hosted, version of this kind of servic…
I've been looking into SuperTokens lately. It's very new, but super promising imo: https://supertokens.io/