51–60 of 326 posts
There's something about Okta that just scares me. If Okta is ever compromised, so are the thousands of companies that rely on it for IdP. How do companies mitigate this risk? Or do they?
stormpath > auth0 > okta > ?? Wonder who buys them next. This will be the third time I've updated my deployments.
Wow. These guys were basically 1 and 2 when it comes to enterprise auth/CIAM. It's great news for the businesses, but will likely only decrease competition in the marketplace. There's a ton of second tier competitors out there with plausible offerings who are probably going to start consolidating to stay alive.
Maybe I'm biased by the large bank I currently work at, but in general, it seems like IAM is the last thing we really want outsourced/closed source and monocultured. If they lose the motivation to stay ahead of the competition, and stop responding to vulnerabilities as quickly as they ought to, it's not just their company that loses.
stormpath > auth0 > okta > ?? Wonder who buys them next. This will be the third time I've updated my deployments.
There's something about Okta that just scares me. If Okta is ever compromised, so are the thousands of companies that rely on it for IdP. How do companies mitigate this risk? Or do they?
When it comes to security, it's often a pretty good idea to put all of your eggs in one basket, and then make sure it's a really, really good basket. Unless you're certain you can make a better basket yourself -- and when it comes to auth, there are a lot of ways to make bad baskets -- it's better to use somebody else's basket.
It's not perfect, but I know I'm not an expert in auth. I use Auth0 and then get on with the rest of my work.
I hope this gives rise to another, smaller viable party outside of Amazon, Google, and Microsoft. Perhaps I'm jaded, perhaps hopelessly biased - but I can only see this as a net negative. Okta's open source packages receive a pitiful amount of attention (for example: https://github.com/okta/okta-oidc-js/issues?q=is%3Aissue+is%... ) with forks almost becoming a requirement. Auth0 by contrast has been "on the ball" for…
Earlier quoted context omitted.
I think the difference is that the scope of DynamoDB is limited. A breach in authentication could result in the complete compromise of a company.
I suspect that a breach of most companies AWS accounts would lead to a complete breach of that company. Somewhere in the mountains of data stored in an AWS account and all it's associated EC2 instances and backups on S3 will be credentials or information to thoroughly breach all other systems.
Earlier quoted context omitted.
> ...who else are a serious option for rock solid SaaS IdP? Google Cloud (Firebase Auth), AWS (Cognito), and Azure (Active Directory) are as rock-solid as they come. FusionAuth.io, userbase.com, and clerk.dev come to mind as well.
Azure Active Directory leaves much to be desired. If it was not a MS product it would struggle to attract a market.