Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

github.com

Post reply on HN
Print view View original

11–20 of 114 posts

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#11

Post by arekkas »

Rodeoclash wrote: post #3

This is a massive release, well done! I run Kratos and Oathkeeper self hosted on ECS for our onboarding app (Xero only in Australia for now I'm afraid, xonboard.com.au). Works like a dream for the most part. One thing which was very painful was adapting the custom UI. I started with an existing example project and adapted it but it was a confusing mix of server code and CSS in JS which made it very difficult to "get…

Our roadmap for this year has a revamped Ory Elements v2, which will make this a lot less painful!

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#12

Post by rad_gruchalski »

YetAnotherNick wrote: post #6
DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.

You haven’t looked for any proof: search for sim cloning.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#13

Post by computerfriend »

YetAnotherNick wrote: post #6
DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.

SMS is better than nothing, but I personally know several people who had their accounts compromised because their SMS 2FA codes were intercepted. It's not possible to do this with TOTP.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#17

Post by Hamuko »

YetAnotherNick wrote: post #6
DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.

https://www.theverge.com/2019/8/31/20841448/jack-dorsey-twit...

https://www.axios.com/2024/01/22/sec-hack-twitter-x-sim-swap

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#18

Post by arekkas »

v3ss0n wrote: post #16

Ory Kratos is so complicated .Authentik is much simpler and easier.

We have worked quite a lot on making Ory Kratos easier to consume. In the release notes you find ~4 CLI commands you can use to get a fully working Ory Kratos up and running, with all UIs and configuration management :) You should give it another try!

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#19

Post by vinckr »

yladiz wrote: post #15
rad_gruchalski wrote: post #14

It’s not really an alternative to Auth0. It’s certainly a component of an alternative to Auth0.

This isn’t very substantive, can you go into more detail about what’s missing?

Ory Kratos is an identity management solution with MFA, passwordless, WebAuthn and so on, so I would argue for most use cases it alone is comparable.

But there are two more Ory services; one for permissions / authZ and an OAuth2 server. You can make use of those to cover the full range of authN/authZ use cases.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#20

Post by OJFord »

DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

Yes, but if you want large enterprise customers such as regulated financial institutions where lots of money's at stake, you will need to support SMS as a second factor, mothers' maiden names, and bypassing all that when the user has forgotten.
Post reply on HN