3 ms·
This reads like it boils down to Stytch sends magic tokens that both authenticate and don't expire. Is that right? And the fix is...expire properly and make th
by djbusby 4y ago
This reads like it boils down to Stytch sends magic tokens that both authenticate and don't expire. Is that right?
And the fix is...expire properly and make the user re-auth or?
Maybe it's like this to handle when the link is opened in a different browsing session?
- nrmitchi 4y agoI don't think that's exactly the point, but yes, it's what the author here is directly stating. Unless I'm misunderstanding, the underlying concern is that Stytch is: - A new authentication company, that focuses 100% on authentication, and - Has raised an absolutely insane amount of money for that, and - Has extremely novice and easy-to-fix issues, and - Those mistakes aren't being immediately addressed I'm not saying that people aren't allowed to make mistakes, and auth mistakes can be very easy to make, but it's way more concerning if you're claiming to be the "Future of User Authentication" while making them. Edit: formatting
- mcstempel 4y agoI think your summary of how the post is framed is correct, but as the founder/CEO of Stytch, I wanted to call out that the claims of the author are incorrect. https://news.ycombinator.com/reply?id=33164969&goto=item%3Fid%3D33162854%2333164969 https://news.ycombinator.com/reply?id=33164969&goto=item%3Fi...