Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

github.com

Post reply on HN
Print view View original

51–60 of 114 posts

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#51

Post by lmeyerov »

arekkas wrote: post #29
aidos wrote: post #26

Earlier quoted context omitted.

Interesting. Any more details available on what’s configurable? How does it work out pricing wise?

The flow is essentially what you see in the small video on the docs page and can be set up in the Ory Network Console with a few clicks. I agree though that the docs here are a bit thin. Pricing wise this is available on the Scale tier currently dubbed as "Enterprise SSO" although "B2B Organizations" probably would be more correct: https://www.ory.sh/pricing/ There are no limits to how many organizations you can have…

So not OSS?

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#52

Post by achandlerwhite »

andix wrote: post #45
DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

It depends. Using SMS as a second (!) factor is fine. There are better options, but SMS is much better than no second factor at all. What you absolutely shouldn't do is allowing password reset only via SMS token, because it's often not that hard to get access to SMS codes via social engineering (convincing a store clerk to issue a new SIM card, or stealing a phone and getting the code displayed on the lock screen) Ha…

This. I wish this distinction was recognized more.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#53

Post by achandlerwhite »

mooreds wrote: post #27
DaiPlusPlus wrote: post #2

> SMS support I thought it was well-established that SMS text messages should not be used for authentication purposes? Here's the original feature-request: https://github.com/ory/kratos/issues/1570 - user @zepatrik raised concerns about this and everyone else just ignored him. Yikes.

SMS has problems, it's true. But every MFA method for consumers has issues, and for some applications it is a viable solution. I wrote more about that here: https://ciamweekly.substack.com/p/ciam-mfa

I think it’s biggest problem is when used for account recovery and password reset, not login 2nd factor.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#54

Post by achandlerwhite »

computerfriend wrote: post #13
YetAnotherNick wrote: post #6

Earlier quoted context omitted.

Everyone says this here, but no one has shown any concrete proof that SMS could be hacked more easily than say TOTP.

SMS is better than nothing, but I personally know several people who had their accounts compromised because their SMS 2FA codes were intercepted. It's not possible to do this with TOTP.

So they had weak passwords? Or were their accounts recovered/reset via SMS which is prevalent but not 2nd factor login.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#55

Post by arekkas »

mooreds wrote: post #35

Congratulations, this is a big release. Some great features in there. Love the phone number as a first class citizen, something we've been considering for a while. (I work for a competitor, FusionAuth.) I noticed account linking, between social accounts and existing accounts, based on email matching, was a new feature. It's documented here: https://www.ory.sh/docs/kratos/social-signin/link-multiple-p... I believe. Th…

We do have all edge cases brought to us solved in terms of account linking and the recent changes further improve the user experience in these scenarios. There are many credential types around these days from passkeys to OTP codes to passwords and OIDC. The biggest challenge is always ensuring the flows are secure which is the hardest part in our view.

ps: I find it a tad frustrating that on every Ory post FusionAuth is shilling in the comments, even if the comment is tangential but clearly intended (through links and name dropping) to draw attention away. It would be much better if FusionAuth focused on releasing open source themselves and truly contributed back to the security community instead.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#56

Post by computerfriend »

mooreds wrote: post #30
computerfriend wrote: post #13

Earlier quoted context omitted.

SMS is better than nothing, but I personally know several people who had their accounts compromised because their SMS 2FA codes were intercepted. It's not possible to do this with TOTP.

How were they intercepted? Was it a sim takeover, where the attacker took over the phone number? Or intercepting the code over the air, since SMS has no encryption?

The latter.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#57

Post by mffap »

aidos wrote: post #43
mffap wrote: post #39

Earlier quoted context omitted.

Have a look at ZITADEL ( https://github.com/zitadel/zitadel or https://zitadel.com/ ), I think that does what you want. You can create multiple tenants (called Organizations) and you can setup security / login rules per organization such as enforcing MFA. Furthermore you can configure on each tenant a separate SSO and users are directly forwarded to their identity provider. When you first enter your username (could b…

That sounds like just what I want. ZITADEL was already on my list to try in the next round. Can you clarify the pricing / plan required for that feature set?

All of these features are included. Main drivers for pricing in this case, I assume will be daily active users (sum over the month) and how many third-party identity providers you have configured. Unlimited tenants, users, permissions etc. are included. We use DAU instead of MAU, since there are many different use cases and that seems work quite well. Just take the MAU and multiply by how many times per month your users will sign-in. In the enterprise tier we offer more custom quotes for higher volumes, guarantee requirements, and support SLAs.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#58

Post by skinner927 »

ravenstine wrote: post #23
arekkas wrote: post #8

Earlier quoted context omitted.

Yes, this is definitely true. However, there are use cases and companies who rely on SMS based two-factor: - Using SMS for phone verification - Using SMS for mobile login (think dating apps for example) - Using SMS for two-factor where other factors are not available / convenient (often in emerging markets) SIM Swap Attack, SIM Port Hacking are all real, but as always in security it comes down to your threat model to…

Plus you have to consider the amount of support you inherit when using something less universal (and generally fool-proof) than SMS. "The one-time code won't work!" "The authenticator app doesn't work!" "The email takes forever to arrive!" "I never got the email!" Most of that sort of thing goes away with SMS. It's not that SMS never fails, but every mobile device takes it, it's relatively simple, and very reliable.…

Meanwhile, the AT&T mobile network is down in the US, heh.

I do agree with your statements.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#59

Post by mooreds »

arekkas wrote: post #55
mooreds wrote: post #35

Congratulations, this is a big release. Some great features in there. Love the phone number as a first class citizen, something we've been considering for a while. (I work for a competitor, FusionAuth.) I noticed account linking, between social accounts and existing accounts, based on email matching, was a new feature. It's documented here: https://www.ory.sh/docs/kratos/social-signin/link-multiple-p... I believe. Th…

We do have all edge cases brought to us solved in terms of account linking and the recent changes further improve the user experience in these scenarios. There are many credential types around these days from passkeys to OTP codes to passwords and OIDC. The biggest challenge is always ensuring the flows are secure which is the hardest part in our view. ps: I find it a tad frustrating that on every Ory post FusionAuth…

That's great you covered all the use cases you've seen. I'm sure you'll continue to build out this useful functionality. Agree that making sure the flows are secure is critical.

> ps: I find it a tad frustrating that on every Ory post FusionAuth is shilling in the comments, even if the comment is tangential but clearly intended (through links and name dropping) to draw attention away.

Hmmm. Appreciate the feedback. I try to avoid shilling, be upfront about my employment, and add useful comments to any auth related posts on HN, not just those about Ory.

I have a lot of respect for what Ory has built (for example, I featured your post about multi-region CIAM in my CIAM newsletter: https://ciamweekly.substack.com/p/multi-region-ciam ), but I will bring my own perspective to my comments, and that is definitely colored by my experience at FusionAuth as well as the fact they employ me.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#60

Post by aidos »

mffap wrote: post #57
aidos wrote: post #43

Earlier quoted context omitted.

That sounds like just what I want. ZITADEL was already on my list to try in the next round. Can you clarify the pricing / plan required for that feature set?

All of these features are included. Main drivers for pricing in this case, I assume will be daily active users (sum over the month) and how many third-party identity providers you have configured. Unlimited tenants, users, permissions etc. are included. We use DAU instead of MAU, since there are many different use cases and that seems work quite well. Just take the MAU and multiply by how many times per month your us…

And to clarify on the third party providers. Assuming every org is using Azure - that’s 1 provider per org. So 53 orgs would be an extra $1,000 / month?
Post reply on HN