7 ms·

I can answer with the opposite question. Why would you trust your homemade solution instead of heavily invested experts? Auth0 (and Okta and a thousand others)

by tootie 6y ago

I can answer with the opposite question. Why would you trust your homemade solution instead of heavily invested experts? Auth0 (and Okta and a thousand others) do nothing but auth and customer management and do it at 1000X the scale as most enterprises. They do it way better than your IT team could possibly do it. And support every cutting edge feature and potential use case. You can also get them to absorb indemnity for damages in case of a breach rather than absorbing the cost yourself. From my POV, you'd be nuts to try to own your own passwords if you're securing anything remotely valuable.

new_guy 6y ago
Authentication is webdev 101. If you can't roll your own you're in the wrong industry. I really can't think of any good reason to hand crucial control of a site over to any third party, much less user authentication where one breach will potentially cost you millions and land you in jail. The whole business model seems to revolve around being a crutch for people not capable or competent of running their own services.
- tschellenbach 6y ago
  Well, if you look at how many sites break auth, or something in the login flow... This is clearly not the case for most companies. Auth is definitely simpler than most problems, but plenty of teams get it wrong.
- chickenpotpie 6y ago
  > I really can't think of any good reason to hand crucial control of a site over to any third party, much less user authentication where one breach will potentially cost you millions and land you in jail. Because Auth0 and other providers have security experts specializing in prevent hacking attempts and there is no way you can do a better job than them unless you make it your full time job.
  - yannoninator 6y ago
    or, you could just do passwordless email auth and not have any security issues whatsoever.
    - mynameisvlad 6y ago
      Sure, because “do passwordless emails” is just a snap of the finger away, right? The point is that doing auth properly is hard. Sending an email might be easy, but creating and managing the session in a secure fashion is hard, even if you’re “just doing passwordless email auth”.
      - yannoninator 6y ago
        > Sure, because “do passwordless emails” is just a snap of the finger away, right? uh, yes? https://magic.link/ https://magic.link/ > The point is that doing auth properly is hard... it works just like password reset no? there's not much state with passwordless email auth as opposed to passwords.
        mynameisvlad 6y ago
        This whole comment thread is about not outsourcing your user management stack to a third party and your intended suggestion is.... A different third party? I don't think I understand exactly what your argument is.
        yannoninator 6y ago
        You said: > Sure, because “do passwordless emails” is just a snap of the finger away, right? And I showed it literally is. The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all. I've done these type of systems before at scale and it took minutes to do (works just like a password reset mechanism) and it is very trivial. In your original comment above, I think you are projecting this a bit too much.
- tootie 6y ago
  Building a form and hashing a password is webdev 101, but go look at the feature set offered by Auth0 or other CIAM platforms. Passwordless auth, MFA, compliance management, customer profiling, workflows, threat detection, analytics. And then think about how much they charge for doing this all for you out of the box versus hiring a dev team and running them forever to support it.
aidos 6y ago
Both of the services you mentioned have had major outages in the past. Maybe it’ll never happen again, but your customers don’t want to hear about why they can’t currently do business because some service they don’t even know about, in which you’re hosting their data, isn’t working. As ever, there are trade offs and you take the good with the bad.
- sixstringtheory 6y ago
  Outages occur all the time. What difference does it make where exactly they're originating from if the end result is the same, from the end user's POV? You give them the same message in either case: "we're experiencing a temporary outage and are working on a remediation." I suppose you'll also be compensated according to contract SLAs, and if the hypothetical becomes actual, you can tune your contract renewal based on your observed losses in revenue accordingly. Best case scenario, there's healthy competition in the space, providing more alternatives and allowing you to end your contract with them if the service sucks. Worst case scenario I guess is that the company implodes taking all its data with it, affecting untold amounts of businesses. A GDPR-like regulation stipulating the ability to export that data (so, user databases) would go a long way towards mitigating prolonged outages in that worst case, and in the best case of the worst case, their competitors are able to import the exports. And/or tools that can spin up a $database instance in $cloud.
taytus 6y ago
Because I'm a software engineer who has been building stuff like this for years...
- ketzo 6y ago
  I mean, if you're an auth expert, that's awesome; but I think it's the absolute height of engineer hubris to pretend that the efforts of any one individual, no matter how talented and experienced, are able to match an entire organization of people who do nothing but this one thing. Now, trusting this particular third-party? Definitely a big question mark! It's on them to earn your trust. But I think to say that third parties in general can't be trusted with your users is to be a little ignorant of the modern web engineering landscape. We trust a lot of people with a lot of things, and not in an unreasonable manner.
dsr_ 6y ago
If UnicornAuthorization manages ten billion credentials, one breach could kill the company... and severely wound every single customer. If JaneService manages ten thousand credentials and has a breach, it could put JaneService out of business, but it won't affect MonicaSoft.
iovoid 6y ago
You can have both (control over your data and expert backing) if you use open source solutions with an enterprise support plan (RedHat's model).
bgdam 6y ago
Have you seen the privacy policy for this service? Clearly not GDPR compatible. Simply using this means you cannot service the EU. Also, if your issue is that owning your user passwords is difficult, then I'm sorry that's just the nature of the problem. It doesn't get any easier by offloading the problem to a third party. Bcrypting passwords is not rocket science anyway. MFA libraries exist for pretty much any server library you use. Sure a company dedicated to doing user management will definitely do a better job than you, but only if your needs align with those of the majority of its users. The minute you want something custom,and trust me you will you're back to doing user management yourself. Only now you have a giant opaque blackbox to deal with. Also, tomorrow if Google buys the company,I'll have 20 hours of notice to integrate my own user management before they shut it down. If Facebook buys it, they'll use my user data for targeting their advertising. Either way, I'm in deep trouble (If I care about my users, which I think most people will). Even ignoring these, the simple fact is that by the very nature of the company, it is a much bigger target for people trying to break into and steal user information,than my little saas could ever be. I'd wager for most people using such services they'd be more likely to get hacked as collateral damage rather than being targeted.

by tootie 6y ago

new_guy 6y ago

Authentication is webdev 101. If you can't roll your own you're in the wrong industry. I really can't think of any good reason to hand crucial control of a site over to any third party, much less user authentication where one breach will potentially cost you millions and land you in jail. The whole business model seems to revolve around being a crutch for people not capable or competent of running their own services.

tschellenbach 6y ago
Well, if you look at how many sites break auth, or something in the login flow... This is clearly not the case for most companies. Auth is definitely simpler than most problems, but plenty of teams get it wrong.
chickenpotpie 6y ago
> I really can't think of any good reason to hand crucial control of a site over to any third party, much less user authentication where one breach will potentially cost you millions and land you in jail. Because Auth0 and other providers have security experts specializing in prevent hacking attempts and there is no way you can do a better job than them unless you make it your full time job.
- yannoninator 6y ago
  or, you could just do passwordless email auth and not have any security issues whatsoever.
  - mynameisvlad 6y ago
    Sure, because “do passwordless emails” is just a snap of the finger away, right? The point is that doing auth properly is hard. Sending an email might be easy, but creating and managing the session in a secure fashion is hard, even if you’re “just doing passwordless email auth”.
    - yannoninator 6y ago
      > Sure, because “do passwordless emails” is just a snap of the finger away, right? uh, yes? https://magic.link/ https://magic.link/ > The point is that doing auth properly is hard... it works just like password reset no? there's not much state with passwordless email auth as opposed to passwords.
      - mynameisvlad 6y ago
        This whole comment thread is about not outsourcing your user management stack to a third party and your intended suggestion is.... A different third party? I don't think I understand exactly what your argument is.
        yannoninator 6y ago
        You said: > Sure, because “do passwordless emails” is just a snap of the finger away, right? And I showed it literally is. The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all. I've done these type of systems before at scale and it took minutes to do (works just like a password reset mechanism) and it is very trivial. In your original comment above, I think you are projecting this a bit too much.
tootie 6y ago
Building a form and hashing a password is webdev 101, but go look at the feature set offered by Auth0 or other CIAM platforms. Passwordless auth, MFA, compliance management, customer profiling, workflows, threat detection, analytics. And then think about how much they charge for doing this all for you out of the box versus hiring a dev team and running them forever to support it.

aidos 6y ago

Both of the services you mentioned have had major outages in the past. Maybe it’ll never happen again, but your customers don’t want to hear about why they can’t currently do business because some service they don’t even know about, in which you’re hosting their data, isn’t working. As ever, there are trade offs and you take the good with the bad.

sixstringtheory 6y ago
Outages occur all the time. What difference does it make where exactly they're originating from if the end result is the same, from the end user's POV? You give them the same message in either case: "we're experiencing a temporary outage and are working on a remediation." I suppose you'll also be compensated according to contract SLAs, and if the hypothetical becomes actual, you can tune your contract renewal based on your observed losses in revenue accordingly. Best case scenario, there's healthy competition in the space, providing more alternatives and allowing you to end your contract with them if the service sucks. Worst case scenario I guess is that the company implodes taking all its data with it, affecting untold amounts of businesses. A GDPR-like regulation stipulating the ability to export that data (so, user databases) would go a long way towards mitigating prolonged outages in that worst case, and in the best case of the worst case, their competitors are able to import the exports. And/or tools that can spin up a $database instance in $cloud.

taytus 6y ago

Because I'm a software engineer who has been building stuff like this for years...

ketzo 6y ago
I mean, if you're an auth expert, that's awesome; but I think it's the absolute height of engineer hubris to pretend that the efforts of any one individual, no matter how talented and experienced, are able to match an entire organization of people who do nothing but this one thing. Now, trusting this particular third-party? Definitely a big question mark! It's on them to earn your trust. But I think to say that third parties in general can't be trusted with your users is to be a little ignorant of the modern web engineering landscape. We trust a lot of people with a lot of things, and not in an unreasonable manner.

dsr_ 6y ago

If UnicornAuthorization manages ten billion credentials, one breach could kill the company... and severely wound every single customer. If JaneService manages ten thousand credentials and has a breach, it could put JaneService out of business, but it won't affect MonicaSoft.

iovoid 6y ago

You can have both (control over your data and expert backing) if you use open source solutions with an enterprise support plan (RedHat's model).

bgdam 6y ago

Have you seen the privacy policy for this service? Clearly not GDPR compatible. Simply using this means you cannot service the EU. Also, if your issue is that owning your user passwords is difficult, then I'm sorry that's just the nature of the problem. It doesn't get any easier by offloading the problem to a third party. Bcrypting passwords is not rocket science anyway. MFA libraries exist for pretty much any server library you use. Sure a company dedicated to doing user management will definitely do a better job than you, but only if your needs align with those of the majority of its users. The minute you want something custom,and trust me you will you're back to doing user management yourself. Only now you have a giant opaque blackbox to deal with. Also, tomorrow if Google buys the company,I'll have 20 hours of notice to integrate my own user management before they shut it down. If Facebook buys it, they'll use my user data for targeting their advertising. Either way, I'm in deep trouble (If I care about my users, which I think most people will). Even ignoring these, the simple fact is that by the very nature of the company, it is a much bigger target for people trying to break into and steal user information,than my little saas could ever be. I'd wager for most people using such services they'd be more likely to get hacked as collateral damage rather than being targeted.