Show HN: Clerk – all of user management as-a-service, not just authentication

Re:Show HN: Clerk – all of user management as-a-service, not... by chickenpotpie on Monday February 08, 2021 @05:45PM (#26071327)

“Not have any security issues whatsoever” is literally impossible. Passwordless auth is the security equivalent of putting all your eggs in one basket. If someone hacks a users email account, now they have access to your service too. Now I’m pissed that you didn’t let me enable 2fa to prevent that or have multiple secure passwords to isolate the hack to my email. You could have just shelled out the 10 cents it would have cost to have my account in auth0 and prevent all of this with 2fa and fraud detection.

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by yannoninator on Monday February 08, 2021 @06:21PM (#26071715)

just use a fake email?

you don't have to use your real email for everything, even google has forwarding addresses.

and apple has private/forwarding emails as well, so this is a moot point.

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by chickenpotpie on Monday February 08, 2021 @06:24PM (#26071759)

Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by yannoninator on Monday February 08, 2021 @06:29PM (#26071804)

So you hack apple's private forwarding email service right, how would one get in?

I've even used G Mail's forwarding email for 6 years and I've never been hacked.

If you're concerned about this just use a fake email.

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by chickenpotpie on Monday February 08, 2021 @06:37PM (#26071883)

You’ve gone off on a personal tangent about how I as a user can increase my security. The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues. An individual can mitigate them, but they still exist

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by yannoninator on Monday February 08, 2021 @07:12PM (#26072168)

> The topic of discussion was you claimed passwordless security had no security issues and I pointed out possible security issues.

But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple.

So are you saying I can be hacked through this way, please provide evidence of this happening in a real world passwordless scenario.

> An individual can mitigate them, but they still exist

Again, I would be more convinced of real world evidence and statistics rather than theorising.

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by chickenpotpie on Monday February 08, 2021 @08:16PM (#26072663)

> But you claimed that the email can be hacked, I used an email forwarding service provided by google or apple.

I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues. Not every user is going to do that and theyre gonna blame you when they get hacked.

> Again, I would be more convinced of real world evidence and statistics rather than theorising.

You first. You made the initial claim that passwordless login has no security issues. Systems should be assumed insecure unless proven otherwise.

[ Parent | on HN ]

Re:Show HN: Clerk – all of user management as-a-service, not... by yannoninator on Monday February 08, 2021 @09:02PM (#26072985)

> I'm not arguing than an intelligent user can't get rid of security issues. I'm saying a product that uses passwordless login still has security issues.

Like what? you keep saying "still has security issues", but you don't give any real world examples. Just saying "still has security issues" is not a good argument.

> You first.

Lots of companies use this method in the real world, Slack, Medium, Freetrade, Substack, Monzo (a bank) and many more.

If a bank and a stock trading app is comfortable using this method, I am sure they are comfortable with the security of this method.

In addition, I already have given examples in this thread which you willingly choose to ignore.

Your turn, start with this:

> Forwarding email increases risk of being hacked. They only have to get one of the emails to get into my account.

Proof?

[ Parent | on HN ]