>Firebase mandates Google / GSuite sign-in
Is Firebase authentication different from GCP Identity Platform? I've read the docs for both Firebase and Identity Platform and the lines seem blurred..
Do these issues extend to Identity platform? I haven't heard of many people using it, but it looks very feature-rich.
Firebase Auth is great, with the notable exception that I am worried it will become Google project #2898 to die on the vine. It has received virtually no substantive updates for about 2.5 years. The last big one was they added SMS 2FA in early 2020. Given that Google themselves has long ago stated SMS is insecure for 2FA, it's ridiculous they have no other options, nor have they said anything about adding options in their official channels. Here's a post from Dec 2021 in the google groups forum, and again there have been no real substantive updates since: https://groups.google.com/g/firebase-talk/c/RBRdDHPybC8
> Is Firebase Authentication dead?
> I apologize for the inflammatory subject line, but I think this is an important matter that the Firebase and Google team should be transparent about.
> What does the future of Firebase Authentication look like? Is it in maintenance mode? Is there any roadmap for future development?
> I migrated my user base to the Firebase platform a few years ago, mainly based on their Authentication platform. It looked like it had a lot of promise. There was a lot of development going on with it at the time. Although it didn't have all features I wanted, the pace of development seemed to show a good trend line going in that direction. At the time, they said MFA was on the roadmap. I considered other AaaS options, but chose Firebase Auth based on where I thought it was going in the future.
> Fast forward a few years, and it seems like there is no activity any more with Firebase Auth. I'm still waiting for TOTP and WebAuthN MFA. SMS is not a no-starter, and even Google has said that SMS is not secure MFA. There is no way to control the password strength policy, nor lock-out behavior when incorrect passwords are entered.
> Now I need to make a decision: whether to stick with Firebase Auth, or to move on to a different AaaS platform. Will Firebase Auth pick up the feature development pace again, or is it on a long death spiral? I'd appreciate insight from Google what their plans are in a concrete way.
> Thank you.
One nice thing about Firebase auth: you can at least get your password hashes out, so a migration that doesn't overly impact your users is possible.
This is in contrast to Amazon Cognito and Azure AD B2C, both of which don't allow you to export the hashes.
More on how to do such an export here: https://fusionauth.io/blog/2022/05/25/how-to-migrate-from-fi...