Hacker News Reader

Comment by tootie | Hacker News Reader

I can answer with the opposite question. Why would you trust your homemade solution instead of heavily invested experts? Auth0 (and Okta and a thousand others) do nothing but auth and customer management and do it at 1000X the scale as most enterprises. They do it way better than your IT team could possibly do it. And support every cutting edge feature and potential use case. You can also get them to absorb indemnity for damages in case of a breach rather than absorbing the cost yourself. From my POV, you'd be nuts to try to own your own passwords if you're securing anything remotely valuable.

View on HN

Both of the services you mentioned have had major outages in the past. Maybe it’ll never happen again, but your customers don’t want to hear about why they can’t currently do business because some service they don’t even know about, in which you’re hosting their data, isn’t working.

As ever, there are trade offs and you take the good with the bad.

Outages occur all the time. What difference does it make where exactly they're originating from if the end result is the same, from the end user's POV? You give them the same message in either case: "we're experiencing a temporary outage and are working on a remediation." I suppose you'll also be compensated according to contract SLAs, and if the hypothetical becomes actual, you can tune your contract renewal based on your observed losses in revenue accordingly.

Best case scenario, there's healthy competition in the space, providing more alternatives and allowing you to end your contract with them if the service sucks. Worst case scenario I guess is that the company implodes taking all its data with it, affecting untold amounts of businesses. A GDPR-like regulation stipulating the ability to export that data (so, user databases) would go a long way towards mitigating prolonged outages in that worst case, and in the best case of the worst case, their competitors are able to import the exports. And/or tools that can spin up a $database instance in $cloud.

Have you seen the privacy policy for this service? Clearly not GDPR compatible. Simply using this means you cannot service the EU.

Also, if your issue is that owning your user passwords is difficult, then I'm sorry that's just the nature of the problem. It doesn't get any easier by offloading the problem to a third party. Bcrypting passwords is not rocket science anyway. MFA libraries exist for pretty much any server library you use.

Sure a company dedicated to doing user management will definitely do a better job than you, but only if your needs align with those of the majority of its users. The minute you want something custom,and trust me you will you're back to doing user management yourself. Only now you have a giant opaque blackbox to deal with.

Also, tomorrow if Google buys the company,I'll have 20 hours of notice to integrate my own user management before they shut it down. If Facebook buys it, they'll use my user data for targeting their advertising. Either way, I'm in deep trouble (If I care about my users, which I think most people will).

Even ignoring these, the simple fact is that by the very nature of the company, it is a much bigger target for people trying to break into and steal user information,than my little saas could ever be. I'd wager for most people using such services they'd be more likely to get hacked as collateral damage rather than being targeted.

If UnicornAuthorization manages ten billion credentials, one breach could kill the company... and severely wound every single customer.

If JaneService manages ten thousand credentials and has a breach, it could put JaneService out of business, but it won't affect MonicaSoft.

You can have both (control over your data and expert backing) if you use open source solutions with an enterprise support plan (RedHat's model).

Because I'm a software engineer who has been building stuff like this for years...

I mean, if you're an auth expert, that's awesome; but I think it's the absolute height of engineer hubris to pretend that the efforts of any one individual, no matter how talented and experienced, are able to match an entire organization of people who do nothing but this one thing.

Now, trusting this particular third-party? Definitely a big question mark! It's on them to earn your trust. But I think to say that third parties in general can't be trusted with your users is to be a little ignorant of the modern web engineering landscape. We trust a lot of people with a lot of things, and not in an unreasonable manner.

Authentication is webdev 101. If you can't roll your own you're in the wrong industry.

I really can't think of any good reason to hand crucial control of a site over to any third party, much less user authentication where one breach will potentially cost you millions and land you in jail.

The whole business model seems to revolve around being a crutch for people not capable or competent of running their own services.

Well, if you look at how many sites break auth, or something in the login flow... This is clearly not the case for most companies. Auth is definitely simpler than most problems, but plenty of teams get it wrong.

> I really can't think of any good reason to hand crucial control of a site over to any third party, much less user authentication where one breach will potentially cost you millions and land you in jail.

Because Auth0 and other providers have security experts specializing in prevent hacking attempts and there is no way you can do a better job than them unless you make it your full time job.

or, you could just do passwordless email auth and not have any security issues whatsoever.

Sure, because “do passwordless emails” is just a snap of the finger away, right?

The point is that doing auth properly is hard. Sending an email might be easy, but creating and managing the session in a secure fashion is hard, even if you’re “just doing passwordless email auth”.

> Sure, because “do passwordless emails” is just a snap of the finger away, right?

uh, yes?

https://magic.link/

> The point is that doing auth properly is hard...

it works just like password reset no?

there's not much state with passwordless email auth as opposed to passwords.

This whole comment thread is about not outsourcing your user management stack to a third party and your intended suggestion is.... A different third party?

I don't think I understand exactly what your argument is.

You said:

> Sure, because “do passwordless emails” is just a snap of the finger away, right?

And I showed it literally is.

The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all.

I've done these type of systems before at scale and it took minutes to do (works just like a password reset mechanism) and it is very trivial.

In your original comment above, I think you are projecting this a bit too much.

Top comment: why would you trust a 3rd party with accounts?

Next Comment: Because they are better at security

Your comment: Or you can do passwordless yourself and have no security problems

Next comment: You can't just do passwordless with a snap of the finger

Your comment: Yeah just use a 3rd party

You're incorrect about the thread

Ok it’s not just me then. I felt like I was taking crazy pills when reading the replies, and the ones to the sibling comment thread where they pivoted to talking about personal security with magic links when this entire conversation has been about companies implementing user management solutions.

This is a very reductionist assessment of the thread and glosses over one important detail I said here:

> The choice is yours to reimplement this authentication system, but in terms of "a snap of the finger away", You can do that, That is all.

It doesn't matter if it's a 3rd party, it is still an option that exists "a snap of the finger away", which was my response to that comment, this type of system can be done in an hour, 3rd party or library.

But if you want to speed things up, then there's your solution.

That was the point, but go ahead and try and reduce and spin this to your own interpretation.

“Not have any security issues whatsoever” is literally impossible. Passwordless auth is the security equivalent of putting all your eggs in one basket. If someone hacks a users email account, now they have access to your service too. Now I’m pissed that you didn’t let me enable 2fa to prevent that or have multiple secure passwords to isolate the hack to my email. You could have just shelled out the 10 cents it would have cost to have my account in auth0 and prevent all of this with 2fa and fraud detection.

just use a fake email?

you don't have to use your real email for everything, even google has forwarding addresses.

and apple has private/forwarding emails as well, so this is a moot point.

Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.

So you hack apple's private forwarding email service right, how would one get in?

I've even used G Mail's forwarding email for 6 years and I've never been hacked.

If you're concerned about this just use a fake email.

You’ve gone off on a personal tangent about how I as a user can increase my security. The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. An individual can mitigate them, but they still exist

> The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues.

But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple.

So are you saying I can be hacked through this way, please provide evidence of this happening in a real world passwordless scenario.

> An individual can mitigate them, but they still exist

Again, I would be more convinced of real world evidence and statistics rather than theorising.

> But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple.

I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues. Not every user is going to do that and theyre gonna blame you when they get hacked.

> Again, I would be more convinced of real world evidence and statistics rather than theorising.

You first. You made the initial claim that passwordless login has no security issues. Systems should be assumed insecure unless proven otherwise.

> I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues.

Like what? you keep saying "still has security issues", but you don't give any real world examples. Just saying "still has security issues" is not a good argument.

> You first.

Lots of companies use this method in the real world, Slack, Medium, Freetrade, Substack, Monzo (a bank) and many more.

If a bank and a stock trading app is comfortable using this method, I am sure they are comfortable with the security of this method.

In addition, I already have given examples in this thread which you willingly choose to ignore.

Your turn, start with this:

> Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.

Proof?

Building a form and hashing a password is webdev 101, but go look at the feature set offered by Auth0 or other CIAM platforms. Passwordless auth, MFA, compliance management, customer profiling, workflows, threat detection, analytics. And then think about how much they charge for doing this all for you out of the box versus hiring a dev team and running them forever to support it.

Reply on news.ycombinator.com