Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

github.com

Post reply on HN
Print view View original

71–80 of 114 posts

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#71

Post by jillesvangurp »

https://securityboulevard.com/2021/12/why-using-sms-authenti...

SMS is an anti feature at this point. This just moves the problem. Arguably email is actually better than SMS and that's not saying much. It's the difference between getting stabbed and shot.

What's the most common thing that people have stolen: wallets and phones. Lots of people have cheap phones, pre-paid sims, or worse. Tying your identity to some phone number that should be treated as temporary only to get locked out of your account some years later is just not great.

Here's a list of reasons people change phone numbers:

- they have a prepaid number and they switch to a different provider

- they travel and use a different sim while traveling

- they change job and lose access to their employer provided phone

- they change operator and the operator declines to take over the old number (happened to me in Germany)

- their phone number ends up on some list of scammers and to get out of the non stop spam by simply getting another number

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#72

Post by andix »

ofrzeta wrote: post #64
andix wrote: post #46

Earlier quoted context omitted.

It's not just emerging markets. Many people are not capable of setting up authenticator apps, not everyone is a "techy" and not everyone is smart. Those people use the internet too. SMS token is something that is much easier to use. 2FA with SMS is still a lot of added security in comparison to no second factor at all. Especially for people who use insecure passwords.

> Many people are not capable of setting up authenticator apps, not everyone is a "techy" and not everyone is smart. That might be true but on the other hand most companies using Teams etc. will be introducing 2FA with the MS Authenticator App. Techie or not, you need to install an app and scan a QR code.

Once again, not every person using the internet is working for a company.

If you don't know anyone that will just laugh at you when you tell them "it's super easy, you just need to install an app and scan a QR code", then you're living inside a bubble. Every year at my mums birthday party her friends already queue up in front of me, so I can install some apps for them.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#73

Post by andix »

achandlerwhite wrote: post #52
andix wrote: post #45

Earlier quoted context omitted.

It depends. Using SMS as a second (!) factor is fine. There are better options, but SMS is much better than no second factor at all. What you absolutely shouldn't do is allowing password reset only via SMS token, because it's often not that hard to get access to SMS codes via social engineering (convincing a store clerk to issue a new SIM card, or stealing a phone and getting the code displayed on the lock screen) Ha…

This. I wish this distinction was recognized more.

Sadly people are like sheep. They hear SMS and shout unsafe.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#75

Post by ravenstine »

skinner927 wrote: post #58
ravenstine wrote: post #23

Earlier quoted context omitted.

Plus you have to consider the amount of support you inherit when using something less universal (and generally fool-proof) than SMS. "The one-time code won't work!" "The authenticator app doesn't work!" "The email takes forever to arrive!" "I never got the email!" Most of that sort of thing goes away with SMS. It's not that SMS never fails, but every mobile device takes it, it's relatively simple, and very reliable.…

Meanwhile, the AT&T mobile network is down in the US, heh. I do agree with your statements.

Gotta admit, it's a funny coincidence. Stupendous timing, AT&T.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#76

Post by doctorpangloss »

Rodeoclash wrote: post #3

This is a massive release, well done! I run Kratos and Oathkeeper self hosted on ECS for our onboarding app (Xero only in Australia for now I'm afraid, xonboard.com.au). Works like a dream for the most part. One thing which was very painful was adapting the custom UI. I started with an existing example project and adapted it but it was a confusing mix of server code and CSS in JS which made it very difficult to "get…

> One thing which was very painful was adapting the custom UI. I started with an existing example project and adapted it but it was a confusing mix of server code and CSS in JS which made it very difficult to "get at" some of the HTML / CSS.

I cannot wrap my mind around why the vendors don't separate the UI and backend application; and then in the UI project, author it in something ubiquitous like React.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#77

Post by mcstempel »

aidos wrote: post #22

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…

We built Stytch's B2B SaaS solution with this specific shortcoming in mind -- most other solutions aren't actually built with an organization-first data model (they're user-first like Auth0 but support the general concept of orgs), which makes it difficult to offer those per organization controls in an ergonomic manner.

There's some more info on our multi-tenancy data model here (https://stytch.com/docs/b2b/guides/multi-tenancy), and here's the PUT request you'd use to manage any of those org configurations: https://stytch.com/docs/b2b/api/update-organization

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#78

Post by bonton89 »

Terretta wrote: post #65
arekkas wrote: post #8

Earlier quoted context omitted.

Yes, this is definitely true. However, there are use cases and companies who rely on SMS based two-factor: - Using SMS for phone verification - Using SMS for mobile login (think dating apps for example) - Using SMS for two-factor where other factors are not available / convenient (often in emerging markets) SIM Swap Attack, SIM Port Hacking are all real, but as always in security it comes down to your threat model to…

It mostly doesn't make sense, unless used exclusively as second factor, never only factor. - phone verification: OK, but this wasn't about that, and having to have phone numbers in a database means you're maintaining PII, which is a liability, see regulator-related story below. - mobile login (think dating apps): should be passkey, sign in with Google/Apple, or oauth of users' choice, see Twitter story below - two fa…

SMS 2FA is only ostensibly about security. Mobile providers always sucked at it and never advertising that they were selling high quality identification services in the first place. They've actually gotten better at it but it wasn't ever there thing and still isn't.

Phone numbers are excellent PII for user tracking though AND allow companies to dump a lot of the hard support work on some one else. Gobbling up PII to sell and externalizing the hard support stuff to some one else is how tech companies and increasingly any company works these days. So it isn't a surprise it isn't going anywhere. You'll likely need to cough up a number at least for "verification" anyway (since they want it) so they'll probably just use that for account recovery to while they're at it to make their lives easier.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#79

Post by manishsharan »

jillesvangurp wrote: post #71

https://securityboulevard.com/2021/12/why-using-sms-authenti... SMS is an anti feature at this point. This just moves the problem. Arguably email is actually better than SMS and that's not saying much. It's the difference between getting stabbed and shot. What's the most common thing that people have stolen: wallets and phones. Lots of people have cheap phones, pre-paid sims, or worse. Tying your identity to some pho…

I discovered another reason to avoid SMS OTP: I am currently visiting India and I have put my phone in Airplane mode because my Canadian phone company , Rogers,charges $15 per day for roaming and it is simply cheaper to buy an Indian SIM card and use it on an old phone to act as a wifi hotspot for my actual phone. So while my phone is in Airplane mode, I am unable to use my RBC Visa or MasterCard for any online purchases in India as there is no way for me to get the SMS OTP without paying Rogers the CA$15 .

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#80

Post by YetAnotherNick »

computerfriend wrote: post #56
mooreds wrote: post #30

Earlier quoted context omitted.

How were they intercepted? Was it a sim takeover, where the attacker took over the phone number? Or intercepting the code over the air, since SMS has no encryption?

The latter.

How can I someone see other's messages? Surely someone has step by step guide if it is that easy. Are you sure it was interception without SIM takeover?
Post reply on HN