Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Okta to Acquire Auth0 for $6.5B

cnbc.com

Post reply on HN
Print view View original

61–70 of 326 posts

Re: Okta to Acquire Auth0 for $6.5B

#61

Post by irgeek »

ignoramous wrote: post #24
sytringy05 wrote: post #14

Wow, I wonder if this will create some space for a new competitor? I mean apart from these 2, who else are a serious option for rock solid SaaS IdP?

> ...who else are a serious option for rock solid SaaS IdP? Google Cloud (Firebase Auth), AWS (Cognito), and Azure (Active Directory) are as rock-solid as they come. FusionAuth.io, userbase.com, and clerk.dev come to mind as well.

Cognito is a joke. It’s full of bugs, the hosted UI doesn’t support half the features and -- based on the change velocity I’ve seen over the last three years —- it is desperately under-resourced by AWS. The new releases always seem to be small changes (like adding a new OAuth provider) but never fixes for the major bugs.

Re: Okta to Acquire Auth0 for $6.5B

#62

Post by rurp »

temuze wrote: post #42
invokestatic wrote: post #30

There's something about Okta that just scares me. If Okta is ever compromised, so are the thousands of companies that rely on it for IdP. How do companies mitigate this risk? Or do they?

That's the same fear some people have about password managers... IMO, the answer is simple: I would rather security be done by a company where security is THE feature. In other words, I trust 1Password's security team over, say, Hulu's or something.

Sure, but it's not a 1-1 comparison. If Hulu gets compromised you only lose your (hopefully unique) Hulu credentials. If your password manager gets compromised a single attacker gets access to _all_ of your accounts. The security standard for a password manager is much, much higher than pretty much any other service.

Password managers are still the best option for most cases, but having to put such an incredible amount of trust in a single company certainly makes me nervous.

Re: Okta to Acquire Auth0 for $6.5B

#64

Post by turtlebits »

andrew_ wrote: post #50

I hope this gives rise to another, smaller viable party outside of Amazon, Google, and Microsoft. Perhaps I'm jaded, perhaps hopelessly biased - but I can only see this as a net negative. Okta's open source packages receive a pitiful amount of attention (for example: https://github.com/okta/okta-oidc-js/issues?q=is%3Aissue+is%... ) with forks almost becoming a requirement. Auth0 by contrast has been "on the ball" for…

Agreed, I found it hard to write integrations with Okta and ended up using Keycloak and integrating it as an OIDC client.

I found Keycloak extremely easy to setup and work with.

Re: Okta to Acquire Auth0 for $6.5B

#66

Post by octopoc »

andrewstuart2 wrote: post #54
tootie wrote: post #6

Wow. These guys were basically 1 and 2 when it comes to enterprise auth/CIAM. It's great news for the businesses, but will likely only decrease competition in the marketplace. There's a ton of second tier competitors out there with plausible offerings who are probably going to start consolidating to stay alive.

I know it doesn't cover everything Auth0 and Okta presumably provide, but Keycloak is OSS and has RedHat support, and is honestly one of the best IDPs I've ever used in terms of capabilities and friendliness. I know there's also the ory suite in the more cloud-native/recent space, though I can't personally speak to its maturity. Maybe I'm biased by the large bank I currently work at, but in general, it seems like IAM…

I’ve started using KeyCloak by default for my personal projects. Once you know how to integrate it and configure it, you never have to worry about users or roles again. I haven’t used the groups feature yet but I’m optimistic considering how easy Keycloak is to configure. Overall it’s a great tool to have in your tool belt.

Re: Okta to Acquire Auth0 for $6.5B

#67

Post by the_duke »

jfengel wrote: post #57
invokestatic wrote: post #30

There's something about Okta that just scares me. If Okta is ever compromised, so are the thousands of companies that rely on it for IdP. How do companies mitigate this risk? Or do they?

If Okta is ever compromised, they have a team of people working 24 hours a day to deal with it as quickly as possible. And, of course, to prevent it from happening. When it comes to security, it's often a pretty good idea to put all of your eggs in one basket, and then make sure it's a really, really good basket. Unless you're certain you can make a better basket yourself -- and when it comes to auth, there are a lot…

You are arguing from the perspective of a single company, while the parent is arguing from an ecosystem perspective.

Sure, for a single customer it's good to have a widely used product with a big ops and security response team.

But if so many companies use a single provider, the fallout of a compromise also becomes much larger. This makes attacking the system more appealing and attracts more sophisticated adversaries, including state actors.

Also, size doesn't necessarily lead to a better, more secure product. It often does for well-run, modern IT companies.

But any familiarity with the enterprise software space is quite sobering in this regard.

Re: Okta to Acquire Auth0 for $6.5B

#68

Post by dang »

We changed the URL from https://www.okta.com/press-room/press-releases/okta-signs-ag... to a third-party article. Usually though not always, corporate press releases are tepid devices whose purpose is as much not to say things as to say them, or at least not say them outright. So generally we prefer the best third-party article on a topic.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...

(Cases like this are an exception to the 'original source' rule in https://news.ycombinator.com/newsguidelines.html.)

Re: Okta to Acquire Auth0 for $6.5B

#69

Post by femto113 »

tootie wrote: post #40
femto113 wrote: post #33

Earlier quoted context omitted.

Amazon/AWS and Google are big in the identity space too, so I think it makes sense that there's only room one real "third party" option.

Cognito and Firebase are bush league by comparison. They can do the basics well enough if you have the right integration engineers. Okta and Auth0 are light years ahead.

The difference is that Okta/Auth0 is never going to be the only piece of a solution. With AWS it's more than just Cognito, you have to consider IAM and SSO as part of the equation as well. And if you're a pure AWS shop the AWSness of Cognito (or its direct support in API Gateway, etc.) might make you prefer it to Okta or Auth0 regardless of feature parity. For Google the key asset is really Gmail/GSuite/Workspace, which is the primary identity provider for many, many organizations (and the sole identity provider for most of those). However kludgy Google's built in SAML stuff is there is a huge value in only needing to deal with one entity.

Re: Okta to Acquire Auth0 for $6.5B

#70

Post by technics256 »

ignoramous wrote: post #24
sytringy05 wrote: post #14

Wow, I wonder if this will create some space for a new competitor? I mean apart from these 2, who else are a serious option for rock solid SaaS IdP?

> ...who else are a serious option for rock solid SaaS IdP? Google Cloud (Firebase Auth), AWS (Cognito), and Azure (Active Directory) are as rock-solid as they come. FusionAuth.io, userbase.com, and clerk.dev come to mind as well.

Anyone who's used cognito knows it's a joke compared to the others.
Post reply on HN