Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

github.com

Post reply on HN
Print view View original

91–100 of 114 posts

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#91

Post by jhugo »

zinekeller wrote: post #37
asdaq1312512 wrote: post #21

Earlier quoted context omitted.

> - Using SMS for mobile login (think dating apps for example) Dating apps in particular seem to be a problematic example to me. In some regions, phone numbers change owners quite easily (e.g., no possibility to port a phone number to a new contract, and quick re-cycling of the phone number when a contract is terminated).

To be fair, it really depends on the region you're operating. Some regions (like most places in Asia) use this as the primary identifier (instead of email), so despite the very obvious security flaws you might be simply be forced to offer it.

Right, by this point the global norm is to rarely, if ever, use email (or a computer larger than a smartphone) unless you work in an office (and in some places not even then). The phone number is the primary identifier for mass-market apps in most countries.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#92

Post by andix »

OJFord wrote: post #87
andix wrote: post #47

Earlier quoted context omitted.

Interesting, in the European Union SMS token are mostly illegal for financial services, because they are not considered safe enough.

That's either recent or wrong, I'm in the UK and certainly they're not new since 2019 or whenever we left (I was going to say 16 but I realised that was the vote not actual exit, but longer than that anyway).

I think the last extended deadline of PSD2 was end of 2020, so after Brexit.

And it's not unheard of, that some countries just ignore EU regulations. Especially if they are going to exit the EU before they can be fined ;)

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#93

Post by andix »

TheNewsIsHere wrote: post #85
andix wrote: post #47

Earlier quoted context omitted.

Interesting, in the European Union SMS token are mostly illegal for financial services, because they are not considered safe enough.

It would be lovely to have that in the U.S., but I doubt it will go anywhere anytime soon. I'm sympathetic to the reasons. The U.S. has a massive population of people who for various reasons will not or cannot adopt methods other than SMS, if that. Meanwhile you can call up some of our largest financial institutions and impersonate someone with public-record knowledge. Many organizations will allow you to skip any ki…

Still funny to hear that everyone in the US has a social security number, although there is no public healthcare for everybody. And I always thought it's the land of unlimited freedom, doesn't seem to apply to privacy.

I have a social security number too, but I need it to get free (actually less expensive) healthcare. Not for opening a bank account. I think in my country nobody except health care is allowed to process social security numbers, because it's considered private information. They are not allowed to store them. If they get them by accident they need to delete them ;)

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#94

Post by esafak »

Sytten wrote: post #50
mooreds wrote: post #35

Congratulations, this is a big release. Some great features in there. Love the phone number as a first class citizen, something we've been considering for a while. (I work for a competitor, FusionAuth.) I noticed account linking, between social accounts and existing accounts, based on email matching, was a new feature. It's documented here: https://www.ory.sh/docs/kratos/social-signin/link-multiple-p... I believe. Th…

My experience is that in general edge cases are not kratos strong suit. Works very well for the base case but anything fancy you are generally on your own. But I don't mind since it is OSS and someone can contribute/fork if they it.

What edge cases did you run into?

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#95

Post by paulddraper »

jillesvangurp wrote: post #71

https://securityboulevard.com/2021/12/why-using-sms-authenti... SMS is an anti feature at this point. This just moves the problem. Arguably email is actually better than SMS and that's not saying much. It's the difference between getting stabbed and shot. What's the most common thing that people have stolen: wallets and phones. Lots of people have cheap phones, pre-paid sims, or worse. Tying your identity to some pho…

If my SMS is compromised, it's one thousand times easier to shut it down and recover than if my email is compromised.

^ Right?

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#96

Post by [deleted] »

manishsharan wrote: post #79
jillesvangurp wrote: post #71

https://securityboulevard.com/2021/12/why-using-sms-authenti... SMS is an anti feature at this point. This just moves the problem. Arguably email is actually better than SMS and that's not saying much. It's the difference between getting stabbed and shot. What's the most common thing that people have stolen: wallets and phones. Lots of people have cheap phones, pre-paid sims, or worse. Tying your identity to some pho…

I discovered another reason to avoid SMS OTP: I am currently visiting India and I have put my phone in Airplane mode because my Canadian phone company , Rogers,charges $15 per day for roaming and it is simply cheaper to buy an Indian SIM card and use it on an old phone to act as a wifi hotspot for my actual phone. So while my phone is in Airplane mode, I am unable to use my RBC Visa or MasterCard for any online purch…

[deleted]

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#97

Post by aidos »

grinich wrote: post #62
aidos wrote: post #22

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…

Have you tried WorkOS? It’s built for exactly this, with native support for SAML and SCIM. https://workos.com/ I’m the founder. Would love to hear your feedback and happy to answer questions.

No, I haven’t tried it. It looks great but unfortunately the per connection pricing makes it not ideal for us. (We’ve had a couple of messages back and forth on here in the past about it). Most of our customers have low numbers of users, so the per subscription cost becomes a bit high.

I’ll kick the tyres in my next round of investigation though to see how it looks.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#98

Post by esafak »

aidos wrote: post #22

Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…

Most of the commercial solutions break financially when you have a freemium tier; orgs that don't pay below a certain size or usage. Yet the auth provider charges you the same fee for each such org.

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#99

Post by esafak »

aidos wrote: post #97
grinich wrote: post #62

Earlier quoted context omitted.

Have you tried WorkOS? It’s built for exactly this, with native support for SAML and SCIM. https://workos.com/ I’m the founder. Would love to hear your feedback and happy to answer questions.

No, I haven’t tried it. It looks great but unfortunately the per connection pricing makes it not ideal for us. (We’ve had a couple of messages back and forth on here in the past about it). Most of our customers have low numbers of users, so the per subscription cost becomes a bit high. I’ll kick the tyres in my next round of investigation though to see how it looks.

What's on your shortlist?

Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support

#100

Post by softveda »

manishsharan wrote: post #79
jillesvangurp wrote: post #71

https://securityboulevard.com/2021/12/why-using-sms-authenti... SMS is an anti feature at this point. This just moves the problem. Arguably email is actually better than SMS and that's not saying much. It's the difference between getting stabbed and shot. What's the most common thing that people have stolen: wallets and phones. Lots of people have cheap phones, pre-paid sims, or worse. Tying your identity to some pho…

I discovered another reason to avoid SMS OTP: I am currently visiting India and I have put my phone in Airplane mode because my Canadian phone company , Rogers,charges $15 per day for roaming and it is simply cheaper to buy an Indian SIM card and use it on an old phone to act as a wifi hotspot for my actual phone. So while my phone is in Airplane mode, I am unable to use my RBC Visa or MasterCard for any online purch…

That is very high. Australian providers offer free incoming SMS even when roaming internationally. The charge is only for data which you can disable. Vodafone Australia has $5/day roaming.
Post reply on HN