Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
1–10 of 114 posts
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#2> SMS support
I thought it was well-established that SMS text messages should not be used for authentication purposes?
Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#3This is a massive release, well done! I run Kratos and Oathkeeper self hosted on ECS for our onboarding app (Xero only in Australia for now I'm afraid, xonboard.com.au). Works like a dream for the most part.
One thing which was very painful was adapting the custom UI. I started with an existing example project and adapted it but it was a confusing mix of server code and CSS in JS which made it very difficult to "get at" some of the HTML / CSS.
Any movement on that front with the project?
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#4> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.
Right. But for validation they can still be useful if you need a way to prevent (or at least hinder) users to create lots of accounts.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#5> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.
Yes, exactly. SMS should be an option because it is obsolete, and therefore unsecure.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#6> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.
Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#7> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.
Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.
there are tons of articles here in HN that have shown that SIM swamp (at least in US) is much easier then trying to brute force (or using quantum computer) to break TOTP encryption. One of main reason for SMS is also meta data collection of your number.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#8> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.
Yes, this is definitely true. However, there are use cases and companies who rely on SMS based two-factor:
- Using SMS for phone verification
- Using SMS for mobile login (think dating apps for example)
- Using SMS for two-factor where other factors are not available / convenient (often in emerging markets)
SIM Swap Attack, SIM Port Hacking are all real, but as always in security it comes down to your threat model to decide what's acceptable risk and what isn't.
Hope this makes sense (maintainer here).
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#9> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.
Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.
You can use social engineering (or corrupted workers) to issue SIM card for other people and receive SMS. This method is widely used to steal money from bank accounts in my country. Telegram accounts also known to be stolen this way.
Of course you should be located in the same country. But it's a risk nonetheless.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#10Is this comparable to Authentik?