Ory Kratos is using 7 docker containers to run, seems super heavy compare to Keycloak that will run with just 2 containers. What is justifying the bloat?
Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
101–110 of 114 posts
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#102Earlier quoted context omitted.
How can I someone see other's messages? Surely someone has step by step guide if it is that easy. Are you sure it was interception without SIM takeover?
It's not that you can do this just from any old device by flipping a built-in switch, but it's not that different from observing plaintext traffic over an Ethernet network with the right software. There are various ways to nab an SMS. Some are similar to SIM swap attacks in that they rely on social engineering or human or process fallibility to execute [1] [2], and others can grab messages right right out of the air,…
Again, I want the tool through which I can see other people's messages, or at least a video of some hacker doing that. e.g. I can observe plaintext message over ethernet by using some splitter and wireshark.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#103Ory Kratos is using 7 docker containers to run, seems super heavy compare to Keycloak that will run with just 2 containers. What is justifying the bloat?
I looked at using the Ory stack when they were much younger, and had some chats with their team. Ory builds everything with the expectation that you're a large enterprise, where service classes and systems are expected to be scaled. They're also pretty big k8s adopters, so they all but expect that you want to run your workloads in a large environment. Great for folks that are bringing Auth* home from Auth0/Okta, etc, as scaling for each app class is right there, but also a much more complex stack to begin with.
That said, where are you seeing 7 containers? I haven't grabbed the repo to run it, but their quickstart instructions use config overlays to manage specific configs, and none of the examples looked like more than 5 containers, 4+ your database, with 1 of them being a dev mail endpoint. Separating tasks out to 3 different services, frontend, backend, and DB migration, doesn't seem super big to me.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#104Earlier quoted context omitted.
You haven’t looked for any proof: search for sim cloning.
In the first link: > In SIM cloning attack, the fraudster gains access to the victims physical SIM card and.. Same thing could be done with TOTP.
It’s not the same. The explanation you quote is wrong.
This is the correct one:
> SIM cloning is the procedure through which a genuine SIM card is reproduced. When the cloning is accomplished, the cloned SIM card’s classifying information is transported onto a separate, secondary SIM card. The secondary card can then be used in a different phone while consuming all the calls and related charges credited to the original SIM card.
https://fraud.net/d/sim-cloning/
There is no need to have physical access.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#105Note that this software unethically phones home with your usage data without your consent. Such opt-out, on-by-default spyware exfiltrates your data silently. They claim it’s anonymous, but that’s false as it includes your client IP address, which frequently maps directly to physical location. You have to patch it out, because even if you try to turn it off, it still phones home in violation of your expressed wishes:…
If you look in the source code for this software which is provided for everyone to see you will realize that Kevin Goslar is entirely innocent of this heinous crime. He merely added the copyright headers to each file. You misunderstand the purpose of the SQA telemetry. There are some reasons for SQA telemetry listed in the doc you posted: - Be able to say how many production deployments exist. - Understand which feat…
Developers are not entitled to knowledge of what software runs or does not run on machines that do not belong to them.
To co-opt those machines without the consent of the user or device owner means your software is malware. To do so even after the user has explicitly opted out is even worse, and in my opinion, is criminal behavior.
With consent, it’s fine. Without consent, it is the same as any other spying.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#106Magic links to email and sms, which are unencrypted, for signup and login, account linking and then converting the session cookies to valid jwt? I smell a CVE within a year.
All password resets lead back to email.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#107Earlier quoted context omitted.
Yes, but if you want large enterprise customers such as regulated financial institutions where lots of money's at stake, you will need to support SMS as a second factor, mothers' maiden names, and bypassing all that when the user has forgotten.
Interesting, in the European Union SMS token are mostly illegal for financial services, because they are not considered safe enough.
I can cleary assert that is not the case in all the European countries where I have bank accounts.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#108Earlier quoted context omitted.
All of these features are included. Main drivers for pricing in this case, I assume will be daily active users (sum over the month) and how many third-party identity providers you have configured. Unlimited tenants, users, permissions etc. are included. We use DAU instead of MAU, since there are many different use cases and that seems work quite well. Just take the MAU and multiply by how many times per month your us…
And to clarify on the third party providers. Assuming every org is using Azure - that’s 1 provider per org. So 53 orgs would be an extra $1,000 / month?
Yes that's correct. Get a quote for your use case, if you are already running on higher numbers. Pricing might not fit all cases, that's why there's also an Enterprise tier.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#109Seems like a good place to ask: Does anyone have advice on good solutions for B2B SAAS apps? Just our app that needs logging in to and would like to allow the usual things (password, social etc) but also allow customising the rules per email domain. For example, if someone enters someone@example.com in to the login form they'll be shuffled off to this Azure connection for authentication. Or maybe they use our login p…
We built Stytch's B2B SaaS solution with this specific shortcoming in mind -- most other solutions aren't actually built with an organization-first data model (they're user-first like Auth0 but support the general concept of orgs), which makes it difficult to offer those per organization controls in an ergonomic manner. There's some more info on our multi-tenancy data model here ( https://stytch.com/docs/b2b/guides/m…
That looks really close to what I’m after! Will give it a spin.
Re: Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
#110Earlier quoted context omitted.
That's either recent or wrong, I'm in the UK and certainly they're not new since 2019 or whenever we left (I was going to say 16 but I realised that was the vote not actual exit, but longer than that anyway).
I think the last extended deadline of PSD2 was end of 2020, so after Brexit. And it's not unheard of, that some countries just ignore EU regulations. Especially if they are going to exit the EU before they can be fined ;)
We have PSD2 though; I think we're voluntarily (or perhaps conditional in the exit negotiation) signed up to it anyway, perhaps so that 'open banking' works internationally still?
Just from a cursory 'psd2 sms multifactor' search, I can't see anything definitively saying it's not allowed though? I can see 'must use secure MFA' (implying it might be pretty open to interpretation) and blogspam type sites saying 'the short answer is yes [SMS can be used]' or 'can be as simple as implementing SMS and voice'.
This one seems reasonable - https://www.onespan.com/blog/psd2-end-sms-based-authenticati... - and though his opinion is that it's not up to scratch, it does make it seem like it comes down to interpretation and your willingness to defend your position. Unless you know that it literally says 'must not use SMS' now?
Two examples I can think of are Santander, and NS&I (run by UK gov). The latter might not be a 'payment service' though I suppose (savings accounts only). I think NewDay (rebadged credit card aaS provider) too.