4 ms·

>Authentication out of the box is nice. (Built-in Firebase email-verification is, in our opinion, a poor experience though). >Firebase mandates Google / GSuite

>Authentication out of the box is nice. (Built-in Firebase email-verification is, in our opinion, a poor experience though). >Firebase mandates Google / GSuite sign-in Is Firebase authentication different from GCP Identity Platform? I've read the docs for both Firebase and Identity Platform and the lines seem blurred.. Do these issues extend to Identity platform? I haven't heard of many people using it, but it looks very feature-rich.

dilatedmind 4y ago
They are the same, there is also some functionality for managing firebase auth users in the gcp console.
hn_throwaway_99 4y ago
Yes, they are the essentially the same (again, more confusing branding). Firebase Auth is great, with the notable exception that I am worried it will become Google project #2898 to die on the vine. It has received virtually no substantive updates for about 2.5 years. The last big one was they added SMS 2FA in early 2020. Given that Google themselves has long ago stated SMS is insecure for 2FA, it's ridiculous they have no other options, nor have they said anything about adding options in their official channels. Here's a post from Dec 2021 in the google groups forum, and again there have been no real substantive updates since: https://groups.google.com/g/firebase-talk/c/RBRdDHPybC8 https://groups.google.com/g/firebase-talk/c/RBRdDHPybC8 > Is Firebase Authentication dead? > I apologize for the inflammatory subject line, but I think this is an important matter that the Firebase and Google team should be transparent about. > What does the future of Firebase Authentication look like? Is it in maintenance mode? Is there any roadmap for future development? > I migrated my user base to the Firebase platform a few years ago, mainly based on their Authentication platform. It looked like it had a lot of promise. There was a lot of development going on with it at the time. Although it didn't have all features I wanted, the pace of development seemed to show a good trend line going in that direction. At the time, they said MFA was on the roadmap. I considered other AaaS options, but chose Firebase Auth based on where I thought it was going in the future. > Fast forward a few years, and it seems like there is no activity any more with Firebase Auth. I'm still waiting for TOTP and WebAuthN MFA. SMS is not a no-starter, and even Google has said that SMS is not secure MFA. There is no way to control the password strength policy, nor lock-out behavior when incorrect passwords are entered. > Now I need to make a decision: whether to stick with Firebase Auth, or to move on to a different AaaS platform. Will Firebase Auth pick up the feature development pace again, or is it on a long death spiral? I'd appreciate insight from Google what their plans are in a concrete way. > Thank you.
- mooreds 4y ago
  Disclosure: I work for FusionAuth, which is a competitor of Firebase Auth. One nice thing about Firebase auth: you can at least get your password hashes out, so a migration that doesn't overly impact your users is possible. This is in contrast to Amazon Cognito and Azure AD B2C, both of which don't allow you to export the hashes. More on how to do such an export here: https://fusionauth.io/blog/2022/05/25/how-to-migrate-from-firebase https://fusionauth.io/blog/2022/05/25/how-to-migrate-from-fi...

dilatedmind 4y ago

They are the same, there is also some functionality for managing firebase auth users in the gcp console.

hn_throwaway_99 4y ago

Yes, they are the essentially the same (again, more confusing branding). Firebase Auth is great, with the notable exception that I am worried it will become Google project #2898 to die on the vine. It has received virtually no substantive updates for about 2.5 years. The last big one was they added SMS 2FA in early 2020. Given that Google themselves has long ago stated SMS is insecure for 2FA, it's ridiculous they have no other options, nor have they said anything about adding options in their official channels. Here's a post from Dec 2021 in the google groups forum, and again there have been no real substantive updates since: https://groups.google.com/g/firebase-talk/c/RBRdDHPybC8 https://groups.google.com/g/firebase-talk/c/RBRdDHPybC8 > Is Firebase Authentication dead? > I apologize for the inflammatory subject line, but I think this is an important matter that the Firebase and Google team should be transparent about. > What does the future of Firebase Authentication look like? Is it in maintenance mode? Is there any roadmap for future development? > I migrated my user base to the Firebase platform a few years ago, mainly based on their Authentication platform. It looked like it had a lot of promise. There was a lot of development going on with it at the time. Although it didn't have all features I wanted, the pace of development seemed to show a good trend line going in that direction. At the time, they said MFA was on the roadmap. I considered other AaaS options, but chose Firebase Auth based on where I thought it was going in the future. > Fast forward a few years, and it seems like there is no activity any more with Firebase Auth. I'm still waiting for TOTP and WebAuthN MFA. SMS is not a no-starter, and even Google has said that SMS is not secure MFA. There is no way to control the password strength policy, nor lock-out behavior when incorrect passwords are entered. > Now I need to make a decision: whether to stick with Firebase Auth, or to move on to a different AaaS platform. Will Firebase Auth pick up the feature development pace again, or is it on a long death spiral? I'd appreciate insight from Google what their plans are in a concrete way. > Thank you.

mooreds 4y ago
Disclosure: I work for FusionAuth, which is a competitor of Firebase Auth. One nice thing about Firebase auth: you can at least get your password hashes out, so a migration that doesn't overly impact your users is possible. This is in contrast to Amazon Cognito and Azure AD B2C, both of which don't allow you to export the hashes. More on how to do such an export here: https://fusionauth.io/blog/2022/05/25/how-to-migrate-from-firebase https://fusionauth.io/blog/2022/05/25/how-to-migrate-from-fi...