Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

github.com

Post reply on HN
Print view View original

21–30 of 114 posts

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#21

Post by asdaq1312512 »

arekkas wrote: post #8
DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

Yes, this is definitely true. However, there are use cases and companies who rely on SMS based two-factor: - Using SMS for phone verification - Using SMS for mobile login (think dating apps for example) - Using SMS for two-factor where other factors are not available / convenient (often in emerging markets) SIM Swap Attack, SIM Port Hacking are all real, but as always in security it comes down to your threat model to…

> - Using SMS for mobile login (think dating apps for example)

Dating apps in particular seem to be a problematic example to me. In some regions, phone numbers change owners quite easily (e.g., no possibility to port a phone number to a new contract, and quick re-cycling of the phone number when a contract is terminated).

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#22

Post by aidos »

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps?

Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain.

For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login pages, but MFA is enforced.

Things that I've tried (eg Authentik and FusionAuth) weren't well suited for per organisation controls.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#23

Post by ravenstine »

arekkas wrote: post #8
DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

Yes, this is definitely true. However, there are use cases and companies who rely on SMS based two-factor: - Using SMS for phone verification - Using SMS for mobile login (think dating apps for example) - Using SMS for two-factor where other factors are not available / convenient (often in emerging markets) SIM Swap Attack, SIM Port Hacking are all real, but as always in security it comes down to your threat model to…

Plus you have to consider the amount of support you inherit when using something less universal (and generally fool-proof) than SMS.

"The one-time code won't work!"

"The authenticator app doesn't work!"

"The email takes forever to arrive!"

"I never got the email!"

Most of that sort of thing goes away with SMS. It's not that SMS never fails, but every mobile device takes it, it's relatively simple, and very reliable. An alternative approach may be more secure, but require more hand holding, and not every organization wants to do that.

In a similar vein, it's not necessarily prudent to do everything that infosec experts espouse. For an analogy, businesses should consult lawyers, but if they follow every bit of advice from a zealous lawyer, they might never take necessary risks that allow the business to achieve excellence; as well, they may need to dedicate substantially more time and effort on compliance.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#24

Post by arekkas »

aidos wrote: post #22

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…

We have this feature and it is called B2B SSO: https://www.ory.sh/docs/kratos/organizations

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#25

Post by mooreds »

aidos wrote: post #22

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…

Hmm. (I work for FusionAuth, thanks for giving us a try!)

So you want a screen in front of the login process where someone enters their email address, and then a second screen where a variety of login options are presented?

Along with the ability to enforce MFA on a per domain basis?

Anything else you are looking to customize at the domain level, such as password rules or registration ability?

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#26

Post by aidos »

arekkas wrote: post #24
aidos wrote: post #22

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…

We have this feature and it is called B2B SSO: https://www.ory.sh/docs/kratos/organizations

Interesting. Any more details available on what’s configurable? How does it work out pricing wise?

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#27

Post by mooreds »

DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

SMS has problems, it's true. But every MFA method for consumers has issues, and for some applications it is a viable solution.

I wrote more about that here: https://ciamweekly.substack.com/p/ciam-mfa

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#29

Post by arekkas »

aidos wrote: post #26
arekkas wrote: post #24

Earlier quoted context omitted.

We have this feature and it is called B2B SSO: https://www.ory.sh/docs/kratos/organizations

Interesting. Any more details available on what’s configurable? How does it work out pricing wise?

The flow is essentially what you see in the small video on the docs page and can be set up in the Ory Network Console with a few clicks. I agree though that the docs here are a bit thin.

Pricing wise this is available on the Scale tier currently dubbed as "Enterprise SSO" although "B2B Organizations" probably would be more correct: https://www.ory.sh/pricing/

There are no limits to how many organizations you can have.

Regarding MFA - the MFA enforcement typically is the responsibility of the IDP the company owns. So for example dean@companyA.com use Okta and they enforce 2FA for their users. anna@companyB.com use OneLogin and they do not enforce MFA.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#30

Post by mooreds »

computerfriend wrote: post #13
YetAnotherNick wrote: post #6

Earlier quoted context omitted.

Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.

SMS is better than nothing, but I personally know several people who had their accounts compromised because their SMS 2FA codes were intercepted. It's not possible to do this with TOTP.

How were they intercepted? Was it a sim takeover, where the attacker took over the phone number? Or intercepting the code over the air, since SMS has no encryption?
Post reply on HN