I am thinking of using only SMS based authentication for my SaaS. Any suggestions?
How is everyone managing user authentication for their platform?
1–10 of 20 posts
Re: How is everyone managing user authentication for their platform?
#2SAP
Re: How is everyone managing user authentication for their platform?
#3"it really depends!!" on the level of security required for the data/actions that seat behind the authentication - for e.g. for Banking and Financial services - a 2factor auth is a must.
For average usage, mobile based auth is ok - although in that case you are relying on the security infrastructure of telecom operator, which in many country is not that good - e.g. identity theft to hijack someone mobile number is quite common.
Re: How is everyone managing user authentication for their platform?
#4"it really depends!!" on the level of security required for the data/actions that seat behind the authentication - for e.g. for Banking and Financial services - a 2factor auth is a must. For average usage, mobile based auth is ok - although in that case you are relying on the security infrastructure of telecom operator, which in many country is not that good - e.g. identity theft to hijack someone mobile number is qu…
email-based auth is much preferable in my opinion.
Re: How is everyone managing user authentication for their platform?
#5It really depends on who the service is being sold to.
Business - SSO via Oauth2, with Azure AD as a ready to use integration
Developers - SSO via Oauth2, with prepared integrations for Github, Gitlab, Keycloak, Okta, or Google.
Personal banking or services where a tie to your real identity is an absolute must - SSO through your national id provider.
Personal sites with less stringent security - SSO with Google or Apple. Here you may also roll your own identity with user+pass+2fa. I guess this is the category you are interested in based on your suggestion. This is also the category with most variety in the field, for example some sites allow email login and recently passcodes are getting popular here.
Re: How is everyone managing user authentication for their platform?
#6node.js - oidc-provider library with passport.js.
Re: How is everyone managing user authentication for their platform?
#7Definitely NOT with SMS.
Re: How is everyone managing user authentication for their platform?
#8I'm using Firebase Auth for my side project. Pretty easy to get started and has generous free limits. I went with Google Auth and passwordless email links. SMS auth would start getting expensive very quick, especially with international users.
Re: How is everyone managing user authentication for their platform?
#9Don't do anything unusual like SMS. It becomes a friction point where you'll lose people. Email/password, Google auth, and maybe another social depending on your product space is what people are used to.
Re: How is everyone managing user authentication for their platform?
#10scrypt, totp
My firm doesn’t offer SMS to clients unless they explicitly ask for it now.