colinclerk

8 ms·

31.
Show HN: use-stripe-subscription – easily add Stripe Billing to your React app(github.com)
3 points by colinclerk 4y ago|3 comments
32.
Refactoring Stripe’s API for Frontend Access(clerk.dev)
1 points by colinclerk 4y ago|0 comments
33.
Markdoc: Stripe's Markdown-based authoring framework(markdoc.io)
810 points by colinclerk 4y ago|146 comments
34.
How to skip CORS preflights and speed up your API with polyfills(clerk.dev)
3 points by colinclerk 4y ago|0 comments
35.
The future of authentication is both stateful and stateless(clerk.dev)
1 points by colinclerk 4y ago|0 comments
36.
Three ways Clerk is more secure than Stytch for session management(clerk.dev)
3 points by colinclerk 4y ago|0 comments
37.
by colinclerk 4y ago
Hey HN - we’d really appreciate any feedback on this one as it’s still in R&D. One of the bigger questions is with the class name approach. As written in the document, we replace the default class name when the developer provides a stri
38.
by colinclerk 4y ago
Yes, definitely. I think on modern stacks, costs are reducing to the point that most would rather avoid the webhook complexity. It may be domain specific, too. It’s not all that common to need user profile data in the critical path. Auth i
39.
Just-in-time API requests are replacing webhooks(clerk.dev)
8 points by colinclerk 4y ago|2 comments
40.
by colinclerk 5y ago
Hello - I'm the cofounder of Clerk.dev. Congrats on your launch! Indeed, we support password-based authentication. Developers can also choose social login, passwordless, or web3 (instead, or in combination). In practice, ~60% of develo
41.
by colinclerk 5y ago
Perhaps surprisingly, US government guidelines exist, are pretty fantastic, and agree with the author: Memorized secrets SHALL be at least 8 characters in length if chosen by the subscriber. Memorized secrets chosen randomly by the CSP
42.
by colinclerk 5y ago
I agree this is a concern, though more with phishing than social engineering. An attacker site pretends to have their own "Login with HN" implementation, but asks users to put in a code generated from LoginWithHN.com itself. If th
43.
by colinclerk 5y ago
Wow, awesome! We've had a few startups ask for an HN integration at https://clerk.dev and we'll build this in ASAP. It would be great if this could somehow verify whether an HN account has been part of YC cohort. A fe
44.
by colinclerk 5y ago
Check out “rewrites”: https://nextjs.org/docs/api-reference/next.config.js/rewrite...
45.
by colinclerk 5y ago
My favorite way to avoid preflights is to have Next.js handle the reverse proxy. It fits my mental model better to have it code-side instead of putting Cloudflare/Fastly in front.
46.
by colinclerk 5y ago
This is why we can make GET and POST requests without an OPTIONS preflight... Apparently, since developers should already have been protecting against cross-origin requests on GET and POST via other means (CSRF tokens), there was no need fo
47.
by colinclerk 5y ago
Cofounder at clerk.dev here 2021 was an exciting year for Clerk and for authentication more broadly. I wrote this to share where we see traditional auth solutions missing the mark, and a bit about our expectations going forward. It's b
48.
2021: The Year Authentication Saw a Resurgence (and Why)(clerk.dev)
3 points by colinclerk 5y ago|1 comments
49.
by colinclerk 5y ago
(I'm the cofounder at https://clerk.dev ) We - and I'm sure every other vendor - limit OTP tries. The guidelines for authentication are very well-defined by NIST 800-63B. For example: > In all cases, the authenticati
50.
by colinclerk 5y ago
Fixed :) Thank you
51.
by colinclerk 5y ago
There are still some benefits. Your password can probably be bypassed with a "forgot password" flow while the TOTP code cannot. Aside from that, though, I think it's reasonable to argue that the security of password+code in
52.
by colinclerk 5y ago
I personally use 1password for authenticator codes - highly recommend if you haven't seen it: https://support.1password.com/one-time-passwords/ Edit: Didn't answer the actual question - it's something we
53.
by colinclerk 5y ago
Sigh. We're working to normalize better UX around account security at https://clerk.dev It's a sordid affair, but we're making progress. We've reduced our average time to sign-in by about 20% since our launch
54.
by colinclerk 5y ago
I think this new wave of server-enabled React is enabling codebases that are better organized than old MVC stacks. The MVC way was: 1. Look at the route 2. Recognize that this route has, e.g. A Header, A Sidebar, and Content 3. Load
55.
by colinclerk 5y ago
There's no strong requirement to use Node for your backend...your Remix codebase can fetch() data from anywhere in the `loader` function: https://remix.run/docs/en/v1/guides/api-routes#api-routes
56.
by colinclerk 5y ago
We'd love to help with your user management at https://clerk.dev - stack-agnostic Sign Up, Sign In, and User Profile Management - oauth and 2fa included out of the box Others: - stripe.com Atlas for incorporation - vercel.c
57.
by colinclerk 5y ago
Hey HN - probably a little odd of us to share a job listing, but I thought the community might find our concept of "full-stack components" interesting. Please do apply if this sounds exciting to you!
58.
by colinclerk 5y ago
How does everyone feel about Wrangler CLI versus git-triggered deploys through GitHub? I think Vercel and Render are both doing an incredible job with their deploy processes, and a lot is owed to them not requiring use of a CLI. I wonder i
59.
by colinclerk 5y ago
What's crazy to me is that NIST compliance isn't part of SOC-2 certifications or similar. A portion of our customers will ask us about NIST, but it's slimmer than I would have expected.
60.
by colinclerk 5y ago
Disclosure: I am the cofounder https://www.clerk.dev Here's the direct link to NIST 800-63B - it's really a fantastic document with sensible recommendations on every authentication method: https://pages.nist

More ›