10 ms·

Show HN: Userbase – Add user accounts and persistence to your static site

206 points by DVassallo 7y ago

quickthrower2 7y ago
I guess this is similar to Parse or Firebase?
- j-berman 7y ago
  Userbase dev here -- yep, biggest difference from both being that user data is end-to-end encrypted with the user's password by default. Compared to Parse, we offer a simple SaaS product. Compared to Firebase, we have a much simpler pricing structure. Considering how early on we are, we also have the benefit of being much simpler to start using (fewer features/options to wrap your head around and configure) :)
- DVassallo 7y ago
  It is. Main differences: - User data is end-to-end encrypted. - Super simple SDK. - Predictable pricing. (You won't need a cost calculator.) - 100% open source, MIT licensed.
  - tristador 7y ago
    FWIW the current pricing page shows only a starter plan that caps you to 1GB, with no info about what happens after 1GB. Predictable pricing is a good feature, but you don't have that yet. Really cool otherwise, I may use this for something. Great work!
    - DVassallo 7y ago
      Thank you! — Addressed that in the FAQ: https://userbase.com/docs/faq/#faq-7 https://userbase.com/docs/faq/#faq-7 We’re not metering storage yet, so nothing will happen right now. Soon we’ll have another pricing plan with metered storage, and people who happen to be exceeding the limit will be given the choice to upgrade to unlimited metered storage (ala AWS).
paublyrne 7y ago
From the FAQ: What happens if a user forgets the password? Users should always keep a copy of their password in a safe place, such as a password manager. Since the encryption key needs to be decrypted by the user's password, it is not possible to recover an account if the password gets lost. I don't believe this is acceptable for a user authentication service. Password reset functionality must be present for this to be production ready.
- Eikon 7y ago
  This is a case where usability should trump security in most cases. The final user may even think wanting something like this. Until they ultimately lose their password.
  - j-berman 7y ago
    I personally think (and hope) the ever-growing issues surrounding data privacy and the constant stream of data breaches we hear about will push people to demand solutions like this and embrace the tradeoff that comes with it. Hope we get more people using password managers. Hope we get more people thinking more deeply about how they can protect their data. Time will tell what the people want! :) That's my idealistic way of looking at it. Practically speaking, the burden on developers to adhere to GDPR and other data privacy laws is quite high. You can use this service to store sensitive user data and relax :)
    - weego 7y ago
      That'll absolutely not happen in our lifetime if ever. You're projecting your developer centric view onto non-technical users who demand solutions that don't add friction to their lives, if it does it's not solving a problem but just adding a new layer of problems for them.
      - j-berman 7y ago
        Protecting data is solving a problem almost everyone is interested in, including non-technical people. And the existence of password managers disproves your claim regardless. It adds more friction to my life to use a password manager versus an insecure password. We're hitting a very particular tradeoff with this product, one which is largely untapped. We'll see which way the chips fall :)
heinrichhartman 7y ago
Congrats! This looks like a really nice service. Thanks for making this! I am not a front-end preson, but I run a static Jekyll blog hosted on GitHub. I don't want to miss the zero maintenance (!) ease of deployment and network-performance of the GitHub CDN, but I have been missing some dynamic features. Most notably: 1. A view counter per page 2. Comments 3. Signup for Newsletter Form Since the GDPR landed, I have removed my Google Analytics and Disqus plugins. And I am happy with that. No reason to leak PII to third parties, that I can't trust anymore. Is that a use case you want to be supporting on your platform? Looks like, this should not be hard to build with your SDK. Best regards, Heinrich
- weef 7y ago
  Have you looked at https://commento.io/ https://commento.io/ as a replacement for Disqus?
- guu 7y ago
  If I understand correctly currently the data is per user and not shared. If you have a todo app, the user can log in and see and modify their todos but there would be no way for them to share their todos. There is no shared access to a modifiable store which I believe would be necessary for the view counter, comment, and signup use cases.
  - j-berman 7y ago
    This is correct for right now, but data sharing is a feature we're currently in the process of wrapping up and getting reviewed by an independent security team. So this will be possible in the near future
    - guu 7y ago
      Are you thinking of user-to-user sharing (ex: daniel shares his list with justin) or something more global? To give an example: The indiehackers website uses firebase as its data store. It's a blog/forum, so posts and comments made by individual users can be seen by people who don't have accounts. Is this a use case you plan to support in the future? If not, the potential use cases are much narrower than firebase. Not necessarily a bad thing but I'm just trying to understand the product.
tobr 7y ago
Cool, I’ve been looking for something like this! Everything about it gives me the right vibes. If I build a prototype on this, and get some users - is there a path to migrate their accounts and data to a new backend in the future?
- DVassallo 7y ago
  Thank you. Working on it. The next version is expected to have a feature to allow you to export all the data to your own self-hosted backend (without any downtime).
antoineMoPa 7y ago
I really like the model of open source SASS, I hope users will still pay as I plan my own open source SASS for video edition. I think it is the best compromise between my open source values and the basic requirement to make money in life.
soneca 7y ago
Wow, that's exactly what I needed. I see a lot of comments challenging the founder's choice on the trade-off "e2e encryption vs users losing their passwords", so I will explain my use case. I am building a social network (https://www.quidsentio.com https://www.quidsentio.com) with the idea of creating one that reduces the noisiness of current ones (that's why I am calling it a "quiet social network") and also is more privacy-oriented. I see privacy as freedom from being observed, and I am considering three dimensions: free from being observed by strangers (you only add real friends to your network), free from being observed by companies (no ads, no tracking), and free from being observed by thieves (prepared for data breaches). That last point is the harder technical problem to solve and Userbase seems to solve it well. As privacy is a big part of what I am building, I consider the trade-off acceptable for my product. Of course, my copy and UX will have to be especially good to not frustrate users on that end. Still, it is a hard decision to make for a product. But the recovery after lost password option that one of the founders mentioned in one of the comments below (https://news.ycombinator.com/item?id=22145878 https://news.ycombinator.com/item?id=22145878) was decisive, so now I am pretty sure I will add e2e to my product. Other features that make it perfect for me: - It's a SaaS, which helps a lot a solo founder not having to build and maintain an authentication service - It's an API, fits well my serverless architecture (I am using Netlify hosting, Netlify Functions, and FaunaDB) - It's cheap (I am using now Netlify Identity, which is $99/month per 5,000 users after the free tier of 1,000) So, thanks for your work, I will for sure be a happy customer, and I am more excited to make this bet that privacy is/will be something that matters for all people, not just worried developers
- j-berman 7y ago
  This is an awesome comment and makes me very happy. Though I'm not a founder, just the first employee :) Looking forward to seeing what you create with it!! Thank you!
naiyt 7y ago
Wow, this is fortuitous for me. I've been wanting something like this for quite some time, and was literally just thinking about it this morning. I've had a lot of ideas for certain small side projects that have ended up dead in the water, because I really didn't want to even risk being liable for the type of user data I would be storing. This solution is perfect for an application that's targeting privacy focused users. I often don't sign up for services these days because I don't care for the possibility that the maintainer of the site is just casually reading through my data. Some great use cases could be journaling, note taking, a private wiki, etc. For note taking, I actually use Standard Notes (https://standardnotes.org/ https://standardnotes.org/) precisely because of its end to end encryption. For me the lack of password reset is a non issue (especially with modern password managers), something that I gladly trade for the peace of mind that some random developer with database access isn't reading through my private stuff. Obviously if you built something on top of this, you would need to properly educate your users on the tradeoff they're taking.
Existenceblinks 7y ago
The title is advertised as for static site, but If I wanted to build my "app" on top of Userbase, I'd love to pay for extra storage. (Keep the simple pricing, just add a separate storage plan) EDIT :: Oh I just saw the Pro Plan plan in your tweet https://twitter.com/dvassallo/status/1216612542052589569 https://twitter.com/dvassallo/status/1216612542052589569
- DVassallo 7y ago
  Correct. Pro plan with unlimited metered storage, and support for collecting payments coming soon. (Targeting end of April).
gbasin 7y ago
Daniel has been tweeting his journey from Amazon employee to solo-preneur. It's been very fun to follow, I would recommend: https://twitter.com/dvassallo https://twitter.com/dvassallo
adamlangsner 7y ago
What are the differences between this product and Auth0? Why would a dev choose one over the other? Do they target different developers / stacks. Or are they both vying for the same thing?
- DVassallo 7y ago
  Main differences: - An end-to-end encrypted database. - Super simple SDK. - 100% open source, MIT licensed. Both the backend and SDK.
deleted 7y ago
[deleted]
neiman 7y ago
"The easiest way to get started is to create a free admin account..." I'm surprised they don't use Userbase account for their own website.
tuxxy 7y ago
I took a cursory look at the crypto on the backend, and it was mildly concerning. It appears to not be using modern asymmetric primitives. At first glance, it's not insecure or anything... just old[0]. Rather than using something like libsodium's public-key box API, which is wonderful, it's using a 2048-bit Diffie-Hellman Prime group. This isn't really great. You should definitely upgrade to more modern primitives. I can highly suggest libsodium as a drop-in replacement. The other thing about this that's more concerning is that I have no idea if there is any validation going on to prevent small subgroup confinement attacks on this, but I don't really want to spend anymore free time checking this out and I'll leave it as an exercise for the reader/author. Personally, I wouldn't use this product until a few cryptography design decisions were changed. If you're marketing this as a privacy-centric product, there's a lot of work to be done--not just on the Diffie-Hellman usage. 0. https://github.com/encrypted-dev/userbase/blob/master/src/userbase-server/crypto/diffieHellman.js https://github.com/encrypted-dev/userbase/blob/master/src/us...
- deleted 7y ago
  [deleted]
- DVassallo 7y ago
  We’re marketing this as something that can significantly reduce personal data misuse compared to having user data sitting in clear in a MySQL database. The value-add is mainly to the developers. (Although the devs can choose to promote some of that to their users too.)
- sarakayakomzin 7y ago
  https://blog.intothesymmetry.com/2020/01/the-curious-case-of-webcrypto-diffie.html https://blog.intothesymmetry.com/2020/01/the-curious-case-of... seems like it'll break on firefox now.
  - j-berman 7y ago
    We don't use WebCrypto for DH, we're using this npm package: https://github.com/crypto-browserify/diffie-hellman/blob/master/lib/dh.js https://github.com/crypto-browserify/diffie-hellman/blob/mas...
swyx 7y ago
where do social logins like github and twitter rank in your list of priorities? on a more meta level, since you're so open anyway, might want to look into public feature voting/roadmaps. congrats on launching! you know i'm a fan of your work. I don't have a particular use for this product as is right now but gh and twitter logins would actually change my calculus (haha i know this is the annoying user stereotype of "i wont use this unless i have x")
fiatjaf 7y ago
There's a protocol for this and it's called remoteStorage[0]. It has a JavaScript implementation that just works and different compatible servers, plus anyone can run its own. [0]: https://remotestorage.io/ https://remotestorage.io/
persona 7y ago
congratulations on the launch! are there any checks done on the backend to guarantee that the website using the "init(appId)" call is the right one? The attack vector here is a fake website - say "userbose dot com" - where the login would be validated by the backend and can now access all data for that user.
- DVassallo 7y ago
  Adding origin whitelisting is on the roadmap. We're working on 2FA to prevent phishing. And thank you!
stockkid 7y ago
Congrats on shipping. The site looks slick and loads fast. What made you choose the MIT license for your product over other licenses?
- DVassallo 7y ago
  Wanted it to be open, no strings attached. The business comes from providing high-quality hosting and (eventually) pro services (support for accepting payments, etc).

206 points by DVassallo 7y ago

quickthrower2 7y ago

I guess this is similar to Parse or Firebase?

j-berman 7y ago
Userbase dev here -- yep, biggest difference from both being that user data is end-to-end encrypted with the user's password by default. Compared to Parse, we offer a simple SaaS product. Compared to Firebase, we have a much simpler pricing structure. Considering how early on we are, we also have the benefit of being much simpler to start using (fewer features/options to wrap your head around and configure) :)
DVassallo 7y ago
It is. Main differences: - User data is end-to-end encrypted. - Super simple SDK. - Predictable pricing. (You won't need a cost calculator.) - 100% open source, MIT licensed.
- tristador 7y ago
  FWIW the current pricing page shows only a starter plan that caps you to 1GB, with no info about what happens after 1GB. Predictable pricing is a good feature, but you don't have that yet. Really cool otherwise, I may use this for something. Great work!
  - DVassallo 7y ago
    Thank you! — Addressed that in the FAQ: https://userbase.com/docs/faq/#faq-7 https://userbase.com/docs/faq/#faq-7 We’re not metering storage yet, so nothing will happen right now. Soon we’ll have another pricing plan with metered storage, and people who happen to be exceeding the limit will be given the choice to upgrade to unlimited metered storage (ala AWS).

paublyrne 7y ago

From the FAQ: What happens if a user forgets the password? Users should always keep a copy of their password in a safe place, such as a password manager. Since the encryption key needs to be decrypted by the user's password, it is not possible to recover an account if the password gets lost. I don't believe this is acceptable for a user authentication service. Password reset functionality must be present for this to be production ready.

Eikon 7y ago
This is a case where usability should trump security in most cases. The final user may even think wanting something like this. Until they ultimately lose their password.
- j-berman 7y ago
  I personally think (and hope) the ever-growing issues surrounding data privacy and the constant stream of data breaches we hear about will push people to demand solutions like this and embrace the tradeoff that comes with it. Hope we get more people using password managers. Hope we get more people thinking more deeply about how they can protect their data. Time will tell what the people want! :) That's my idealistic way of looking at it. Practically speaking, the burden on developers to adhere to GDPR and other data privacy laws is quite high. You can use this service to store sensitive user data and relax :)
  - weego 7y ago
    That'll absolutely not happen in our lifetime if ever. You're projecting your developer centric view onto non-technical users who demand solutions that don't add friction to their lives, if it does it's not solving a problem but just adding a new layer of problems for them.
    - j-berman 7y ago
      Protecting data is solving a problem almost everyone is interested in, including non-technical people. And the existence of password managers disproves your claim regardless. It adds more friction to my life to use a password manager versus an insecure password. We're hitting a very particular tradeoff with this product, one which is largely untapped. We'll see which way the chips fall :)

heinrichhartman 7y ago

Congrats! This looks like a really nice service. Thanks for making this! I am not a front-end preson, but I run a static Jekyll blog hosted on GitHub. I don't want to miss the zero maintenance (!) ease of deployment and network-performance of the GitHub CDN, but I have been missing some dynamic features. Most notably: 1. A view counter per page 2. Comments 3. Signup for Newsletter Form Since the GDPR landed, I have removed my Google Analytics and Disqus plugins. And I am happy with that. No reason to leak PII to third parties, that I can't trust anymore. Is that a use case you want to be supporting on your platform? Looks like, this should not be hard to build with your SDK. Best regards, Heinrich

weef 7y ago
Have you looked at https://commento.io/ https://commento.io/ as a replacement for Disqus?
guu 7y ago
If I understand correctly currently the data is per user and not shared. If you have a todo app, the user can log in and see and modify their todos but there would be no way for them to share their todos. There is no shared access to a modifiable store which I believe would be necessary for the view counter, comment, and signup use cases.
- j-berman 7y ago
  This is correct for right now, but data sharing is a feature we're currently in the process of wrapping up and getting reviewed by an independent security team. So this will be possible in the near future
  - guu 7y ago
    Are you thinking of user-to-user sharing (ex: daniel shares his list with justin) or something more global? To give an example: The indiehackers website uses firebase as its data store. It's a blog/forum, so posts and comments made by individual users can be seen by people who don't have accounts. Is this a use case you plan to support in the future? If not, the potential use cases are much narrower than firebase. Not necessarily a bad thing but I'm just trying to understand the product.

tobr 7y ago

Cool, I’ve been looking for something like this! Everything about it gives me the right vibes. If I build a prototype on this, and get some users - is there a path to migrate their accounts and data to a new backend in the future?

DVassallo 7y ago
Thank you. Working on it. The next version is expected to have a feature to allow you to export all the data to your own self-hosted backend (without any downtime).

antoineMoPa 7y ago

I really like the model of open source SASS, I hope users will still pay as I plan my own open source SASS for video edition. I think it is the best compromise between my open source values and the basic requirement to make money in life.

soneca 7y ago

Wow, that's exactly what I needed. I see a lot of comments challenging the founder's choice on the trade-off "e2e encryption vs users losing their passwords", so I will explain my use case. I am building a social network (https://www.quidsentio.com https://www.quidsentio.com) with the idea of creating one that reduces the noisiness of current ones (that's why I am calling it a "quiet social network") and also is more privacy-oriented. I see privacy as freedom from being observed, and I am considering three dimensions: free from being observed by strangers (you only add real friends to your network), free from being observed by companies (no ads, no tracking), and free from being observed by thieves (prepared for data breaches). That last point is the harder technical problem to solve and Userbase seems to solve it well. As privacy is a big part of what I am building, I consider the trade-off acceptable for my product. Of course, my copy and UX will have to be especially good to not frustrate users on that end. Still, it is a hard decision to make for a product. But the recovery after lost password option that one of the founders mentioned in one of the comments below (https://news.ycombinator.com/item?id=22145878 https://news.ycombinator.com/item?id=22145878) was decisive, so now I am pretty sure I will add e2e to my product. Other features that make it perfect for me: - It's a SaaS, which helps a lot a solo founder not having to build and maintain an authentication service - It's an API, fits well my serverless architecture (I am using Netlify hosting, Netlify Functions, and FaunaDB) - It's cheap (I am using now Netlify Identity, which is $99/month per 5,000 users after the free tier of 1,000) So, thanks for your work, I will for sure be a happy customer, and I am more excited to make this bet that privacy is/will be something that matters for all people, not just worried developers

j-berman 7y ago
This is an awesome comment and makes me very happy. Though I'm not a founder, just the first employee :) Looking forward to seeing what you create with it!! Thank you!

naiyt 7y ago

Wow, this is fortuitous for me. I've been wanting something like this for quite some time, and was literally just thinking about it this morning. I've had a lot of ideas for certain small side projects that have ended up dead in the water, because I really didn't want to even risk being liable for the type of user data I would be storing. This solution is perfect for an application that's targeting privacy focused users. I often don't sign up for services these days because I don't care for the possibility that the maintainer of the site is just casually reading through my data. Some great use cases could be journaling, note taking, a private wiki, etc. For note taking, I actually use Standard Notes (https://standardnotes.org/ https://standardnotes.org/) precisely because of its end to end encryption. For me the lack of password reset is a non issue (especially with modern password managers), something that I gladly trade for the peace of mind that some random developer with database access isn't reading through my private stuff. Obviously if you built something on top of this, you would need to properly educate your users on the tradeoff they're taking.

Existenceblinks 7y ago

The title is advertised as for static site, but If I wanted to build my "app" on top of Userbase, I'd love to pay for extra storage. (Keep the simple pricing, just add a separate storage plan) EDIT :: Oh I just saw the Pro Plan plan in your tweet https://twitter.com/dvassallo/status/1216612542052589569 https://twitter.com/dvassallo/status/1216612542052589569

DVassallo 7y ago
Correct. Pro plan with unlimited metered storage, and support for collecting payments coming soon. (Targeting end of April).

gbasin 7y ago

Daniel has been tweeting his journey from Amazon employee to solo-preneur. It's been very fun to follow, I would recommend: https://twitter.com/dvassallo https://twitter.com/dvassallo

adamlangsner 7y ago

What are the differences between this product and Auth0? Why would a dev choose one over the other? Do they target different developers / stacks. Or are they both vying for the same thing?

DVassallo 7y ago
Main differences: - An end-to-end encrypted database. - Super simple SDK. - 100% open source, MIT licensed. Both the backend and SDK.

deleted 7y ago

[deleted]

neiman 7y ago

"The easiest way to get started is to create a free admin account..." I'm surprised they don't use Userbase account for their own website.

tuxxy 7y ago

I took a cursory look at the crypto on the backend, and it was mildly concerning. It appears to not be using modern asymmetric primitives. At first glance, it's not insecure or anything... just old[0]. Rather than using something like libsodium's public-key box API, which is wonderful, it's using a 2048-bit Diffie-Hellman Prime group. This isn't really great. You should definitely upgrade to more modern primitives. I can highly suggest libsodium as a drop-in replacement. The other thing about this that's more concerning is that I have no idea if there is any validation going on to prevent small subgroup confinement attacks on this, but I don't really want to spend anymore free time checking this out and I'll leave it as an exercise for the reader/author. Personally, I wouldn't use this product until a few cryptography design decisions were changed. If you're marketing this as a privacy-centric product, there's a lot of work to be done--not just on the Diffie-Hellman usage. 0. https://github.com/encrypted-dev/userbase/blob/master/src/userbase-server/crypto/diffieHellman.js https://github.com/encrypted-dev/userbase/blob/master/src/us...

deleted 7y ago
[deleted]
DVassallo 7y ago
We’re marketing this as something that can significantly reduce personal data misuse compared to having user data sitting in clear in a MySQL database. The value-add is mainly to the developers. (Although the devs can choose to promote some of that to their users too.)
sarakayakomzin 7y ago
https://blog.intothesymmetry.com/2020/01/the-curious-case-of-webcrypto-diffie.html https://blog.intothesymmetry.com/2020/01/the-curious-case-of... seems like it'll break on firefox now.
- j-berman 7y ago
  We don't use WebCrypto for DH, we're using this npm package: https://github.com/crypto-browserify/diffie-hellman/blob/master/lib/dh.js https://github.com/crypto-browserify/diffie-hellman/blob/mas...

swyx 7y ago

where do social logins like github and twitter rank in your list of priorities? on a more meta level, since you're so open anyway, might want to look into public feature voting/roadmaps. congrats on launching! you know i'm a fan of your work. I don't have a particular use for this product as is right now but gh and twitter logins would actually change my calculus (haha i know this is the annoying user stereotype of "i wont use this unless i have x")

fiatjaf 7y ago

There's a protocol for this and it's called remoteStorage[0]. It has a JavaScript implementation that just works and different compatible servers, plus anyone can run its own. [0]: https://remotestorage.io/ https://remotestorage.io/

persona 7y ago

congratulations on the launch! are there any checks done on the backend to guarantee that the website using the "init(appId)" call is the right one? The attack vector here is a fake website - say "userbose dot com" - where the login would be validated by the backend and can now access all data for that user.

DVassallo 7y ago
Adding origin whitelisting is on the roadmap. We're working on 2FA to prevent phishing. And thank you!

stockkid 7y ago

Congrats on shipping. The site looks slick and loads fast. What made you choose the MIT license for your product over other licenses?

DVassallo 7y ago
Wanted it to be open, no strings attached. The business comes from providing high-quality hosting and (eventually) pro services (support for accepting payments, etc).