Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Three things to never build yourself: auth, notifications, payments

courier.com

Post reply on HN
Print view View original

41–50 of 193 posts

Re: Three things to never build yourself: auth, notifications, payments

#41

Post by AlexSW »

rgbrenner wrote: post #27

Never outsource Auth. Maintain control over user accounts. That's the life blood of your business. If you have to ask everyone to reset their password because your auth provider increases their pricing or goes out of business, the churn will likely kill your company. I would say the same for Stripe, but at least they'll help you migrate off their platform. Auth providers cant help you because the passwords are hashed…

Using the same authentication algorithm doesn't seem like a particularly big price to pay, assuming they started with a sensible one. And there's nothing stopping one from making it support the old style but add a more up-to-date algorithm for new password sets, either.

Re: Three things to never build yourself: auth, notifications, payments

#42

Post by [deleted] »

rgbrenner wrote: post #27

Never outsource Auth. Maintain control over user accounts. That's the life blood of your business. If you have to ask everyone to reset their password because your auth provider increases their pricing or goes out of business, the churn will likely kill your company. I would say the same for Stripe, but at least they'll help you migrate off their platform. Auth providers cant help you because the passwords are hashed…

[deleted]

Re: Three things to never build yourself: auth, notifications, payments

#43

Post by mocheeze »

Raed667 wrote: post #36
jchw wrote: post #16

Crap, I’ve done all three! Well, maybe not all at once though. I can see why not to do notifications, but it’s hard to avoid doing some form of it if you’re making an app with focus on low latency realtime updates. The bigger problem is that out of all three categories, I only really feel content with trusting Stripe, and only so much. Auth0 has its issues, and decent authentication systems you can roll on your own a…

I'm curious how people handled payments before Stripe? Did you integrate with banks directly? How different is that in terms of what Stripe offers?

There were, and still are, many gateway providers with APIs for payments. Authorize.net, NMI, USAePay, BrainTree, Payeezy, even Paypal was common enough once upon a time. And those are just a handful that I can list off the top of my head. (I know that some of those I listed have acquired each other recently as well.)

Re: Three things to never build yourself: auth, notifications, payments

#46

Post by troygoode »

void_mint wrote: post #39
rgbrenner wrote: post #27

Never outsource Auth. Maintain control over user accounts. That's the life blood of your business. If you have to ask everyone to reset their password because your auth provider increases their pricing or goes out of business, the churn will likely kill your company. I would say the same for Stripe, but at least they'll help you migrate off their platform. Auth providers cant help you because the passwords are hashed…

> Never outsource Auth. Maintain control over user accounts. This is some of the worst advice I've ever seen on HN. Don't take on risk you don't understand and cannot afford to mitigate. Don't be the next Equifax.

100%. I'm old enough that when I started my career we were still storing credit card numbers on our servers (and many companies were unfortunately doing so in the raw...). PCI compliance luckily knocked some sense into the industry. Crazy to me that some people don't realize that PII and secrets like passwords are basically in the same category now.

Re: Three things to never build yourself: auth, notifications, payments

#47

Post by chaostheory »

rgbrenner wrote: post #27

Never outsource Auth. Maintain control over user accounts. That's the life blood of your business. If you have to ask everyone to reset their password because your auth provider increases their pricing or goes out of business, the churn will likely kill your company. I would say the same for Stripe, but at least they'll help you migrate off their platform. Auth providers cant help you because the passwords are hashed…

You can do both. Just use an open source project for auth instead of reinventing a commodity wheel.

Re: Three things to never build yourself: auth, notifications, payments

#48

Post by mooreds »

rgbrenner wrote: post #27

Never outsource Auth. Maintain control over user accounts. That's the life blood of your business. If you have to ask everyone to reset their password because your auth provider increases their pricing or goes out of business, the churn will likely kill your company. I would say the same for Stripe, but at least they'll help you migrate off their platform. Auth providers cant help you because the passwords are hashed…

You can also choose to self host. Keycloak and FusionAuth (disclosure, I am an employee) let you self host. You then have the user database in your systems.

> And the only way off without a mass password reset is a silent migration in the background: migrate the user when they login.. but we all know that will take months and you will never get 100% to login during the migration period.

Actually, not true. I can't speak for every auth provider, but FusionAuth and Auth0 both let you have the password hashes. If you know the algo (ask your provider!), you can load the hashes (and other ancillary password data like the salt) and your users will never be the wiser.

Here's a guide I wrote about how to migrate off of Auth0: https://fusionauth.io/docs/v1/tech/guides/auth0-migration/ The end goal of the guide is to move to FusionAuth, but the steps to get your password hashes out of Auth0 (the 'Exporting Users' section) will work no matter where you migrate to.

Re: Three things to never build yourself: auth, notifications, payments

#49

Post by _6pvr »

valachio wrote: post #11

This is a biased article. I would not let another company handle authentication or notifications for my apps. Payments, yes.

It's kind of funny that you'd allow someone else to manage money, but you wouldn't let someone else manage something that has the potential to cost you an equal or greater amount of money in GDPR violation fees and lawsuits.

Re: Three things to never build yourself: auth, notifications, payments

#50

Post by jchw »

Raed667 wrote: post #36
jchw wrote: post #16

Crap, I’ve done all three! Well, maybe not all at once though. I can see why not to do notifications, but it’s hard to avoid doing some form of it if you’re making an app with focus on low latency realtime updates. The bigger problem is that out of all three categories, I only really feel content with trusting Stripe, and only so much. Auth0 has its issues, and decent authentication systems you can roll on your own a…

I'm curious how people handled payments before Stripe? Did you integrate with banks directly? How different is that in terms of what Stripe offers?

I guess it depends on what counts as handling payments yourself. Stripe can handle just about everything to managing subscriptions and emailing invoices and more. At least nowadays. It’s a lot more advanced than systems that roughly just provide an API to manage payment methods and charge them, like Authorize.net for example.

Also, handling the abstraction between multiple kinds of payment methods (cryptos, different card networks, PayPal, etc.) may also be a considerable amount of complexity that a payment vendor can help with.

I have never directly interacted with the financial system at its lowest levels. I’ve heard it is quite a trip.

Post reply on HN