I agree, it seems like a strange risk. How easy is it to change authentication provider? How disruptive is that for customers?
I have no experience with this sort of thing, but would like to understand.
I have no experience with this sort of thing, but would like to understand.
Kinde has a self-serve export tool baked in as we believe it is important for people to be able to change provider freely and not have vendor lock-in. We also have a self-serve import tool for organizations and users including hashed passwords so there is no disruption to the end customer
I'm guessing the password hash format is something like bcrypt2? Is there an API for that? The feature quite nicely mitigates a situation where prices are unreasonably raised, but to mitigate a rug-pull event such as a business failure, malicious action or serious technical failure I'd probably want to automate this.
If that sounds like I'm sort of paranoid, it's probably because I am. I do this with all my company's cloud data.
It was a huge issue with Auth0 recently when they were bought by Okta. We've spoken to customers who have had their prices increased 2-20x virtually overnight with no forewarning and they've been forced to go through a process with customer support in order to get access to their user base and move off.
I'll get someone from the team with a better understanding of the password hashing to get back to you on this but I believe it's bcrypt2.
As Dave mentioned we're trying to make it as easy as possible to get your users out. I'll chat to someone from the team about the automation, it's an interesting idea
The self-service export is UI driven at the moment, as exporting passwords requires approval from an additional owner/admin for security. We could definitely extend this to be initiated by API though