91–95 of 95 posts
Congrats BetterAuth! It was the system I was considering before I rolled my own auth system around the passwordless concepts of: OTP + Passkeys + Google login. It is quite nice and simple and I've ported it to 3 separate projects now just via LLM: Talk: https://ben3d.ca/blog/passwordless-login-system Live Demo: https://passwordless.ben3d.ca Demo Code: https://github.com/bhouston/passwordless If you are building a use…
How is BetterAuth in terms of vendor lockin? For a hobby project, I once tried a provider which stored all data within itself and required API calls for every user request. Then I tried Hanko which just authenticates and can be replaced relatively easily (very easily if no passwords IIRC).
Ah, here we go again. Glad I decided to roll my own auth rather then using some library. I had a feeling that eventually they will join Vercel.
Yeah, we rolled our own auth as well. Everybody says you shouldn’t, it’s a risk, etc etc. but to me that’s less risk than our auth getting bought by somebody whose business goals don’t necessarily align with mine.
That goes for protocols as well.
And security-related "build vs. buy" decisions should always include an element of battle-testing. If you have the option to pick an off-the-shelf TLS library rather than implementing your own, both are gonna be full of bugs but at least the former will have already had CVEs filed and fixed. (That's not, btw, an assumption that one likes to write buggy code, but rather, a choice to operate under the assumption that one can always be surprised. Schneier's Law and all).
That said, there comes a point to model your own problem domain, and make sure that your product includes features and components that allow it to meet your information security goals.
I think software engineering has done itself a bit of a disservice by making security seem "scary" (and therefore, something to avoid at all costs) rather than a necessary and boring component of any computer system.
P.S. If anybody wants resources, I'm a big fan of the way that FIPS-199 -> FIPS-200 -> SP 800-53 breaks down security goals, impact levels, and appropriate control measures. You can pick a goal, assess your impact level, and pick something off-the-shelf pretty quickly.
Bereket Here the team at Vercel has been my biggest inspiration and always reflected many of the reasons we started working on Better Auth. This would allow us to focus more on what made better-auth great in the first place It hasn't even been 2 years since we started but thank you everyone from the open-source community for helping us make an impact in short amount of time. There is a lot to do to improve on open so…
Congratulations on the acquisition!
We are building auth for developing markets (secure MFA for users without smartphones).
Would love to get your thoughts on the auth landscape.
I'm +254-seven-zero-seven-144992 on WhatsApp.
Cheers!