Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 Verifiable Credentials

verifiablecredentials.dev

Post reply on HN
Print view View original

91–100 of 134 posts

Re: Auth0 Verifiable Credentials

#91

Post by rocqua »

cassonmars wrote: post #24

I love that verifiable credentials are starting to make mainstream, but one thing I couldn’t glean from this page: is this purely VC from a perspective of “here’s the attributes I care to see”, or “here’s the characteristics I care to see”? To clarify: say I’m an alcohol vendor and wish to confirm that a user is 21 or older. Does the VC issuance provide a range proof that does not reveal the age, or does the VC issua…

VCs are what a user holds. So generally with age you will be issued a credential that includes your age.

However, VCs have the concept of a 'presentation' which is what you show someone that wishes to verify something about you. The 'just show them the data and the digital signature' approach is one way to do presentations. But depending on the actual digital signature, you can also do presentations based on range proofs. Or general zero knowledge proofs.

So the issuer is not using range-proofs. Its the holder who is presenting his credentials that gets to do range proofs. That does depend on the issuer using specific kinds of signatures though.

Re: Auth0 Verifiable Credentials

#93

Post by webloem »

robbie-c wrote: post #89

Tangentially, if you’re a B2C startup like an app, avoid using auth0. Their pricing starts out cheap but once you hit 10k MAU, it’ll go from $X00 a month to a 3 year contract for $X00000. It’s not designed as a business for that use case, and you’ll be paying for a lot of premium features that you’ll never use. If something like Firebase Auth suits your use case, use that instead.

Can confirm, also very dissapointed with Auth0. We have been happily using Auth0 for years within their self-service license tier. Unfortunately we are now in the process of migrating away from Auth0 on short notice.

We never hit 10k MAU, but according to their sales people you can't have multiple tenants without an enterprise license, even though that is not mentioned anywhere in the docs. We have been using them in good faith, however they will not shy away from aggressive sales tactics and threatening to 'de-provision' you if you do not commit to a very expensive license.

Re: Auth0 Verifiable Credentials

#94

Post by robertlagrant »

webloem wrote: post #93
robbie-c wrote: post #89

Tangentially, if you’re a B2C startup like an app, avoid using auth0. Their pricing starts out cheap but once you hit 10k MAU, it’ll go from $X00 a month to a 3 year contract for $X00000. It’s not designed as a business for that use case, and you’ll be paying for a lot of premium features that you’ll never use. If something like Firebase Auth suits your use case, use that instead.

Can confirm, also very dissapointed with Auth0. We have been happily using Auth0 for years within their self-service license tier. Unfortunately we are now in the process of migrating away from Auth0 on short notice. We never hit 10k MAU, but according to their sales people you can't have multiple tenants without an enterprise license, even though that is not mentioned anywhere in the docs. We have been using them in…

I can also confirm that their sales org is very disappointing. The technical side is excellent.

Re: Auth0 Verifiable Credentials

#95

Post by Traubenfuchs »

lifeisstillgood wrote: post #37
Traubenfuchs wrote: post #18

Earlier quoted context omitted.

Offerings in the SSI/VD space are currently exploding -some even government backed. Microsoft, MasterCard, Auth0, the European Union are the biggest players that come to my mind. This will turn the whole billion dollar kyc/identity verification space upside down. I work in that space.

Would you mind expanding on the how ? I am trying to get a handle on whether identity providers / VC providers are going to be 5 big firms or if everyone will do it like everyone used to have a office stamp for banging a red inked logo onto documents

You will have all your email, postal addresses, other PII and (formerly physical) identification documents in a wallet app. Government websites AND private websites will be able to request data from that wallet for login and registration purposes. You will need to approve all requests to your wallet, in the majority of cases by using biometrics (e.g. faceId or non-apple alternatives of it).

This has the potential to eradicate several major avenues of fraud. The more of this is offered (for free) by governments the more it could majorly disrupt (=destroy) the industry around the topic.

Worldwide it seems there is a new, proprietary wallet each month, which naturally totally ruins this idea of having one wallet, but I see what is currently going on as a "storming phase" or almost "norming phase" already, that will eventually reach the "performing phase", with one or two wallets being the survivors. A big stumbling block here is that everyone involved wants a piece of the cake.

The European Union is actively (but slowly) working on this, e.g. with eIDAS. With eIDAS, you create a digital identity in your home country. If that home country DI offering supports eIDAS, you can use it to login to any other government AND private service implementing any DI offering that supports eIDAS.

> whether identity providers / VC providers are going to be 5 big firms

The big firms will provide the ecosystem (e.g. Microsoft Entra, mastercard-id-for-rp, ...), the real identity verification will happen through offerings like Onfido, Jumio and the 1000 other offerings in the space.

Re: Auth0 Verifiable Credentials

#96

Post by methyl »

robbie-c wrote: post #89

Tangentially, if you’re a B2C startup like an app, avoid using auth0. Their pricing starts out cheap but once you hit 10k MAU, it’ll go from $X00 a month to a 3 year contract for $X00000. It’s not designed as a business for that use case, and you’ll be paying for a lot of premium features that you’ll never use. If something like Firebase Auth suits your use case, use that instead.

Can confirm, it got downhill once they got acquired by Okta.

We had to roll our own auth solution because they couldn’t make the pricing even remotely viable.

I’d like to write „stay away from Auth0”, but is there any comparable alternative?

Re: Auth0 Verifiable Credentials

#97

Post by Traubenfuchs »

dwaite wrote: post #74
lifeisstillgood wrote: post #37

Earlier quoted context omitted.

Would you mind expanding on the how ? I am trying to get a handle on whether identity providers / VC providers are going to be 5 big firms or if everyone will do it like everyone used to have a office stamp for banging a red inked logo onto documents

I would expect the VC providers will be the issuing authorities - you won't get a digital driving license from Facebook, you'll get it from the DMV. Now they might not be running their own infrastructure, but they still have to be the one who authorized the credential to be minted. A faux digital National ID card issued from a random social network will likely not let you get access to government services or let you…

You might get your physical ids from the government, but private providers will verify them and create a digital-identity for you. Unless the government also wants to play the role of digital identity provider / VC provider.

Re: Auth0 Verifiable Credentials

#98

Post by webloem »

methyl wrote: post #96
robbie-c wrote: post #89

Tangentially, if you’re a B2C startup like an app, avoid using auth0. Their pricing starts out cheap but once you hit 10k MAU, it’ll go from $X00 a month to a 3 year contract for $X00000. It’s not designed as a business for that use case, and you’ll be paying for a lot of premium features that you’ll never use. If something like Firebase Auth suits your use case, use that instead.

Can confirm, it got downhill once they got acquired by Okta. We had to roll our own auth solution because they couldn’t make the pricing even remotely viable. I’d like to write „stay away from Auth0”, but is there any comparable alternative?

We did quite a bit of research into this.

If you need mostly B2C features I would have a look at Clerk [0] and Supertokens [1]

If you are more interested in B2B features we found Ory [2], FusionAuth [3], and good old Keycloak [4].

None of them are fully comparable yet however, which might be the reason why they might get away with their current behaviour.

[0] https://clerk.dev/ [1] https://supertokens.com/ [2] https://www.ory.sh/ [3] https://fusionauth.io/ [4] https://www.keycloak.org/

Re: Auth0 Verifiable Credentials

#99

Post by enricotal »

vintermann wrote: post #86

Like anything OAuth2-related, it's frustratingly vague and jargony. Verifiable credentials is a terrible name. We have had verifiable cryptographic credentials for more than 40 years. What I want, is a practical protocol to prove to a third party 1. That I am a real person (e.g, has a unique credential issued by my government) 2. That I'm the only one currently "logged in" with them, with that credential. 3. Without…

Verifiable credentials (VC) It's a name that comes from:

https://www.w3.org/TR/vc-data-model/

Re: Auth0 Verifiable Credentials

#100

Post by chrisweekly »

Spooky23 wrote: post #51
CleverLikeAnOx wrote: post #2

This places all the trust in the institution that mints verifiable credentials. (or the institution + Auth0 if they use Auth0). This is good for use cases where you want to assert that an organization says something about you (e.g., you have a degree). It is not good for use cases where you want to assert that you say something (e.g., I voted for Blah, or I authorized this transfer).

You can do that by having consortiums of trusted parties. California, New York and Walmart were pioneers in this space for vaccination credentials. (SMART health cards) If you lived in a crazy state like Florida, vaccinating at Walmart was the best way to get a credential for international travel. In the absence of federal action, countries like Israel recognized these credentials and airlines incorporated them into…

I find it interesting that US states and a massive corporation are directly comparable entities (CA, NY, Walmart, MA) in this context.
Post reply on HN