19 ms·
Something I cannot emphasize enough for startups is to not use your own auth no matter how convenient you might think it is. Github was built before the era of
by bearjaws 4y ago
Something I cannot emphasize enough for startups is to not use your own auth no matter how convenient you might think it is. Github was built before the era of many "Authentication as a service" providers, but this is another example of why you don't roll your own.
- sergiomattei 4y agoI don’t understand. Just about everyone rolls their own auth. This is awful advice. I’d never trust my authentication needs to external providers who can hold my user information hostage.
- bearjaws 4y ago... AWS offers managed authentication service (Cognito), for many websites your data is literally already in AWS. They have zero reason to hold your usernames and emails hostage... The same can be said for GCP (Identity Platform) and Azure.
- joemi 4y agoRolling your own has some benefits, though. Such as not being as big a target as a provider that services many sites, and being more in control of the auth data, and not being reliant on a service that's beyond your control to not suddenly stop working or shut down.
- bearjaws 4y agoFor sure some auth providers will be compromised at some point in the future, but there are literally thousands (tens of thousands?) of examples of self managed identity management being compromised. How many Auth0 or AWS Cognito service compromises have there been? To your point about availability, AWS, GCP and Azure all have managed authentication services, that are fundamental to their platforms. I highly doubt they are going anywhere. I have yet to have an Cognito outage in three years.