putrikarunia

9 ms·

31.
by putrikarunia 7y ago
The trusted device works with mobile apps, and it works by generating cryptographic keys and store in the device's secure storage. It doesn't involve the browser to identify trusted devices. (Trusted device would work with browser
32.
by putrikarunia 7y ago
Oh, yeah, sorry I wasn't clear on this. If App A allows fallback SMS OTP and App B doesn't allow fallback SMS OTP, then you will never be able to login to App B with just having your phone number verified. Our product have 3 featu
33.
by putrikarunia 7y ago
Yes this makes a lot of sense! Thanks for bringing it up.
34.
by putrikarunia 7y ago
Awesome! Thank you for the support :)
35.
by putrikarunia 7y ago
This is a very interesting way of thinking about this. I guess this would be our biggest concern if we are specifically a security product. I think I was too focused on answering your question regarding security :). Basically, yes we do off
36.
by putrikarunia 7y ago
This is a very interesting case. Thanks for pointing this out! If I may ask, do these people also download apps in that phone, and then they log out every time they pass on the phone to someone else?
37.
by putrikarunia 7y ago
Yes, thank you for pointing this out!
38.
by putrikarunia 7y ago
When you lose your only trusted device, then you would have to go through recovery methods, which is set by the website/app depending on what level of security they require. For apps that prefer lower security, higher convenience, then
39.
by putrikarunia 7y ago
Oh you're right, we didn't include this in the text. For businesses with high authentication volume, we offer pricing per MAU or a monthly subscription. Thanks for pointing it out!
40.
by putrikarunia 7y ago
So we wanted the name Otter, but we can't get the domain, so we settled for C-Otter (sea otter). :D
41.
by putrikarunia 7y ago
Yes, this is also the case with FIDO. The private key is stored in the device's secure storage, and only the public key is shared to our server. So the private key is never shared anywhere and not kept by any service. (This is also ver
42.
by putrikarunia 7y ago
Hi, thanks for sharing your experience! So firstly, I agree about how it's only as secure as the recovery process, in which case we give each website/app the freedom to decide for themselves, what level of security they want, comp
43.
by putrikarunia 7y ago
Hi, yes we feel the problem with SMS and how delivery rate is often not 100%. If I may ask, what do you guys use the SMS for? I'm not too sure how reliable it is during peak traffic, but I think probably best not to use SMS as a single
44.
by putrikarunia 7y ago
To add a trusted device, the new device will generate a QR Code, which then have to be scanned by a trusted device. So all logins and adding new trusted devices will still have to be approved by a trusted device. (Similar to how you login t
45.
by putrikarunia 7y ago
Got it, this is quite interesting, I've just read through some of the explanations on SQRL a bit, we're actually following a slightly different protocol, the FIDO protocol https://fidoalliance.org/how-fido-works&#x
46.
by putrikarunia 7y ago
Thank you!
47.
by putrikarunia 7y ago
Hi, can you tell me what you mean by SRQL? is it "Sorted Relational Query Language"?
48.
by putrikarunia 7y ago
Yes, so an API call is an authentication request. To prevent monetary DoS, right now we're thinking of a couple of ways: We're considering to charge per user per month, this way apps/websites would not be charged per api cal
49.
by putrikarunia 7y ago
So what we provide is not an SMS OTP login. SMS OTP is insecure, that's why we recommend apps not to use SMS OTP as a way to authenticate users. The SMS OTP is only used as a way to verify that the phone number is actually active. The
50.
by putrikarunia 7y ago
There isn't any limitations, but we're trying to integrate with local sms providers to offer better rates. We're also going to integrate WhatsApp soon.
51.
by putrikarunia 7y ago
Yeah, that makes sense. Thanks! Any thoughts on our pricing?
52.
by putrikarunia 7y ago
That's awesome! It shouldn't have any issues with multi-sim card phones. The phone number verification would work as if you have multiple Google accounts when trying to sign-in with Google. If you have 2 phone numbers, and have ve
53.
by putrikarunia 7y ago
There would be recovery methods that would be different for each company, depending on how secure they'd like it to be. The least-secure but the most convenient way would be to fall back to SMS OTP to recover the account. If more secur
54.
by putrikarunia 7y ago
You can choose whether you want your clients to login using email or phone number when you're integrating our SDK into your website or app. For our developer account, we choose to use email login. I'll look into the back button pr
55.
by putrikarunia 7y ago
We're actually considering charging per user per month, which would solve the problem if it's the same user logging in multiple times. For the case where people are using different phone numbers and keep on creating new accounts,
56.
by putrikarunia 7y ago
We provide both email and phone number authentication. We think that phone numbers works best for our target users, but for developers, we think that emails are more useful.
57.
by putrikarunia 7y ago
The security comes with the Trusted Device feature, where users can only login from a trusted device. This works like DUO, when there's a login attempt from a different device, the Trusted Device will get a prompt and the user can choo
58.
by putrikarunia 7y ago
Yes, we hope that people in the US would also use this. It also works for email if people are more used to it.
59.
Launch HN: Cotter (YC W20) – Secure One-Click Phone Number Login
111 points by putrikarunia 7y ago|67 comments