3 ms·

I currently use Mozilla Persona to auth 50k users, with at least 15k sign-in events per month over 300 websites. The biggest problems with login box, a.k.a. dr

by buro9 11y ago

I currently use Mozilla Persona to auth 50k users, with at least 15k sign-in events per month over 300 websites. The biggest problems with login box, a.k.a. drov.io: 1) Trust. Who are you? 2) Pricing. Even with 300 sites, 1,000 concurrent users at any given moment, and fully dynamic sites, the proposed pricing for me of EUR 70 per month is a quarter of all my current costs. The cloud has made things very cheap, and this looks very expensive as a result. 3) Multi-user and PaaS. How could I grant access to the membership and management of one slice of users but not the rest? i.e. my 300 sites are on one platform, each site is typically a non-profit who own their own users... in theory they own their user database and I just host it, they should be able to manage it and for me to query that to apply authorisation within my app. 4) Longevity. If I consider moving things over... what happens in 18 months time if you reach the end of your runway? How could I reverse adopting this? 5) How do I identify a user? Assuming you auth them and then say "you're good", what single thing can I use to identify them that is meaningful to me? Persona returns a verified email for all users, are you able to do the same? 6) Are you static site friendly? i.e. Can the pages with the "Sign-in" box be cached and thus allow me to serve great numbers with little hardware, and does loading a page with a "Sign-in" box always trigger a HTTP request to you (if I'm under DDoS attack, is it going to take you down?) 7) How do you manage "email change"? Or things like "I signed in with my Gmail, but now I want to use my Github"? Those things weigh heavily. Happy to talk with you about them, I notice that you're in London and so am I. These sites are side projects, not my main gig... just things that linger and that I still maintain.

ipapikas 11y ago
1) You have a point. One 'Who we are' section coming up. :) 2) If you mean you have 1000 users across all websites you could create a different account for each of them. We know this might become a pain to manage so we are planning to allow users to manage multiple websites in future versions an each will be priced separately. 3) If you're talking about allowing users to give different access levels to their users then we already have that on our roadmap. 4) If anything happens to us we will be providing assistance to website owners to recover their data. We also support user export at any moment and this should cover you. 5) We verify users on signup by asking them to click a link we email to them. Social login also guarantees email verification. 6) Caching and custom login pages is a feature we support at the moment, so that you will be able to avoid calling the loginBox all the time. We are working against DoS attacks in parallel. 7) As long as both accounts have the same email you should be fine. We treat social logins as a verification for the email associated with it. I will email you so we can meet and talk about them! Thanks a lot!

by buro9 11y ago

ipapikas 11y ago

1) You have a point. One 'Who we are' section coming up. :) 2) If you mean you have 1000 users across all websites you could create a different account for each of them. We know this might become a pain to manage so we are planning to allow users to manage multiple websites in future versions an each will be priced separately. 3) If you're talking about allowing users to give different access levels to their users then we already have that on our roadmap. 4) If anything happens to us we will be providing assistance to website owners to recover their data. We also support user export at any moment and this should cover you. 5) We verify users on signup by asking them to click a link we email to them. Social login also guarantees email verification. 6) Caching and custom login pages is a feature we support at the moment, so that you will be able to avoid calling the loginBox all the time. We are working against DoS attacks in parallel. 7) As long as both accounts have the same email you should be fine. We treat social logins as a verification for the email associated with it. I will email you so we can meet and talk about them! Thanks a lot!