Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Auth0 Verifiable Credentials

verifiablecredentials.dev

Post reply on HN
Print view View original

101–110 of 134 posts

Re: Auth0 Verifiable Credentials

#101

Post by OJFord »

Call me a cynic but all this proves is that someone vouched for the stated credential being associated with a key I currently hold?

i.e. you have to check imperial.ac.uk/.well-known/auth0-vc.pub or whatever, and if that matches, still all you know is that I have the key (or device, whatever), not necessarily that it was truly me. And if you don't check the issuer (or don't trust it's claim - impeerial.ac.uk says that the bearer has a degree from imperial.ac.uk for example) then it doesn't tell you anything.

Of course that's not really avoidable... but I can't think of a use case for this that doesn't just reduce to 'the issuer may as well just publish the contents' - it's useful when you want to only selectively share a credential from party A with party B, and it's something that B has reason to doubt/verify... but I can't think of an example?

Re: Auth0 Verifiable Credentials

#102

Post by nailer »

robbie-c wrote: post #89

Tangentially, if you’re a B2C startup like an app, avoid using auth0. Their pricing starts out cheap but once you hit 10k MAU, it’ll go from $X00 a month to a 3 year contract for $X00000. It’s not designed as a business for that use case, and you’ll be paying for a lot of premium features that you’ll never use. If something like Firebase Auth suits your use case, use that instead.

Or just use your favorite oauth / oidc library. AuthZero is for people that need SAML or AD integration or some other legacy tech.

Re: Auth0 Verifiable Credentials

#103

Post by brabel »

Traubenfuchs wrote: post #95
lifeisstillgood wrote: post #37

Earlier quoted context omitted.

Would you mind expanding on the how ? I am trying to get a handle on whether identity providers / VC providers are going to be 5 big firms or if everyone will do it like everyone used to have a office stamp for banging a red inked logo onto documents

You will have all your email, postal addresses, other PII and (formerly physical) identification documents in a wallet app. Government websites AND private websites will be able to request data from that wallet for login and registration purposes. You will need to approve all requests to your wallet, in the majority of cases by using biometrics (e.g. faceId or non-apple alternatives of it). This has the potential to…

Just to clarify something important, though... and I hope you agree with me on that: the VCs that matter will be issued by whoever is the authority that takes care of the subject matter... as it's always been the case in the real world.

For example:

- date of birth: issued by your government and equivalent to your birth certificate.

- Occuppational credentials: issued by the relevant, government-authorized organization, like Engineers Australia or whatever.

- Driver's License: issued by the traffic authority in your country/state.

- Proof of Vaccination: this is interesting, as COVID showed... in my country, it was private organizations issuing that, but they had to be approve by the Government.

The only credentials the big social media companies can issue for you just prove you have a certain handle with them, I guess... which could be used for a more secure "Sign in with Google/Apple/GitHub" for example. But nearly all interesting credentials would be issued by real-world authorities, IMHO.

Re: Auth0 Verifiable Credentials

#104

Post by ccbccccbbcccbb »

Next step: "Unfortunately, Chrome can't connect to the Internet right now. We at Google strive for a healthier, more responsible society. Please fill your vaccination details in the form below."

For everyone feeling the kneejerk urge to downvote: https://www.bbc.com/news/world-asia-63456107

Re: Auth0 Verifiable Credentials

#105

Post by thedougd »

CleverLikeAnOx wrote: post #2

This places all the trust in the institution that mints verifiable credentials. (or the institution + Auth0 if they use Auth0). This is good for use cases where you want to assert that an organization says something about you (e.g., you have a degree). It is not good for use cases where you want to assert that you say something (e.g., I voted for Blah, or I authorized this transfer).

I went the Cognito route for customer facing, however there were a couple of gotchas:

- There's no turn key method for multi-region availability.

- It has a limited number of 2FA/MFA options.

- It does not offer a SAML idp. We ended up writing a Lambda to issue SAML claims, put it behind an API gateway with Cognito/OIDC authorization. It works, but we'll need to maintian it.

- It's AWS, so you'll need a half dozen other services to build a complete solution

Re: Auth0 Verifiable Credentials

#106

Post by mooreds »

webloem wrote: post #98
methyl wrote: post #96

Earlier quoted context omitted.

Can confirm, it got downhill once they got acquired by Okta. We had to roll our own auth solution because they couldn’t make the pricing even remotely viable. I’d like to write „stay away from Auth0”, but is there any comparable alternative?

We did quite a bit of research into this. If you need mostly B2C features I would have a look at Clerk [0] and Supertokens [1] If you are more interested in B2B features we found Ory [2], FusionAuth [3], and good old Keycloak [4]. None of them are fully comparable yet however, which might be the reason why they might get away with their current behaviour. [0] https://clerk.dev/ [1] https://supertokens.com/ [2] https:…

Thanks for the mention (I work for FusionAuth).

I'm curious what solution you ended up determining best fit your needs?

Re: Auth0 Verifiable Credentials

#107

Post by vdfs »

enricotal wrote: post #99
vintermann wrote: post #86

Like anything OAuth2-related, it's frustratingly vague and jargony. Verifiable credentials is a terrible name. We have had verifiable cryptographic credentials for more than 40 years. What I want, is a practical protocol to prove to a third party 1. That I am a real person (e.g, has a unique credential issued by my government) 2. That I'm the only one currently "logged in" with them, with that credential. 3. Without…

Verifiable credentials (VC) It's a name that comes from: https://www.w3.org/TR/vc-data-model/

Funny how identity0.io (from the website example) was registered less than 24 hours ago

Re: Auth0 Verifiable Credentials

#108

Post by vdfs »

OJFord wrote: post #101

Call me a cynic but all this proves is that someone vouched for the stated credential being associated with a key I currently hold? i.e. you have to check imperial.ac.uk/.well-known/auth0-vc.pub or whatever, and if that matches, still all you know is that I have the key (or device, whatever), not necessarily that it was truly me. And if you don't check the issuer (or don't trust it's claim - impeerial.ac.uk says that…

Right, and to better illustrate this problem, they have a link in "verificationMethod" pointing to identity0.io domain, it was registered by just yesterday, could be just someone snatching that domain

Re: Auth0 Verifiable Credentials

#109

Post by anelson »

robbie-c wrote: post #89

Tangentially, if you’re a B2C startup like an app, avoid using auth0. Their pricing starts out cheap but once you hit 10k MAU, it’ll go from $X00 a month to a 3 year contract for $X00000. It’s not designed as a business for that use case, and you’ll be paying for a lot of premium features that you’ll never use. If something like Firebase Auth suits your use case, use that instead.

That’s been our experience as well. Auth0 seemed like a great deal and we were happy to have such a sensitive component handled by a dedicated third party, but their sales team aggressively pursues us as soon as we go over some MAU limit and it’s clear that the nickel-and-diming is only going to get worse as we grow. We need to migrate away sooner or later.

Re: Auth0 Verifiable Credentials

#110

Post by Spooky23 »

chrisweekly wrote: post #100
Spooky23 wrote: post #51

Earlier quoted context omitted.

You can do that by having consortiums of trusted parties. California, New York and Walmart were pioneers in this space for vaccination credentials. (SMART health cards) If you lived in a crazy state like Florida, vaccinating at Walmart was the best way to get a credential for international travel. In the absence of federal action, countries like Israel recognized these credentials and airlines incorporated them into…

I find it interesting that US states and a massive corporation are directly comparable entities (CA, NY, Walmart, MA) in this context.

Well states operate vaccine registries, but some states for political reasons chose to not really do a good job with them or not issue usable credentials beyond the CDC card. Also, rural states tended to rely more on larger entities like Walmart and pharmacies to deliver vaccinations — Walmart is often the most accessible place for healthcare, food, medicines, etc.

When entities like Apple got in the mix the process got smoother. If your doctor uses Epic, the Health app can usually create a SMART credential directly from your medical records instead of downloading a state app.

It is cool that different entities were able to self organize and deliver a valuable service. It sucks that the Federal government backed away from any leadership role. People in Florida who had to travel abroad often got re-vaccinated at Walmart or in another state, because the Governor wanted to own the libs or whatever.

Post reply on HN