mffap

I'm glad that your grandmother uses a password manager. We actually had a lot of feedback from teens and children and the concept of MFA/2FA seems to be hard to understand for less technical people. We were surprised by the actual understanding after some user research.

Yes, availability on all browsers and devices is not yet up to 100%. I hope to see a fast adoption, but agree that it could actually take some time. I use Passkeys on a daily basis for the last ~1.5 years wherever possible and won't go back anytime soon :)

> Also the page that initiated it should periodically refresh itself to see if the session was validated somewhere else.

I guess the link must be disabled / invalidated after first use and your auth server and client obviously must verify if a given link is still valid.

How should an honest look at the topic include for your, that's lacking in the article? You mentioned the focus on email instead of other channels. Anything else? Thanks for the feedback.

If you'd take a passwordless login with FIDO2 (now promoted "Passkeys" by Apple and Google) it would mainly require to use FaceID / Windows Hello / Fingerprint / PIN ... or whatever your devices deem necessary. Could be used on any and cross-device.

Interesting - thanks for sharing!

https://sso.tax/ a lot of companies put SSO behind a paywall. Not a fan of making users pay for basic security features.

Yes. Self-hosted is free with an option for commercial support. The software we use in our SaaS is identical to what's on our repo.

yes, that's it

Thanks, good to know! Do you have chrome://flags/#enable-experimental-web-platform-features enabled by any chance? Seems to be an Docusaurus issue, we'll make an update.

Firstly let me say that we like both Auth0 and Keycloak - as others have commented the solutions are widely used and have both unique advantages.

We built an open source alternative to Auth0 which fully supports self-hosting (today on K8s, soon as all-in-one binary on multiple platforms). Regarding Keycloak, it is a great project with high maturity and a lot of features, but lacks in support for B2B, cloud-native and manufacturer support. We wrote a blog comparing Auth0 and Keycloak in more detail, when you might want to consider ZITADEL as alternative. Hope that helps.

Appreciate the feedback and insights - thank you. Happy to keep you posted on the javascript client, this is for sure one on our list. Regarding user base, sure Keycloak is very mature and broadly used. We started our SaaS now over 1.5 years ago and continuously build on the feedback and the operational learnings.

We're currently working on v2 with the goal to reduce that complexity. Goal is to make it easier to run a single binary, like you mentioned using Docker. Documentation for this is currently WIP - should be out end of May.

Great. Would love to hear more about your impression and the comparison to Okta. Okta is for sure very mature. Some users who switched liked the fact that you can run ZTIADEL on any infrastructure (self-hosting) as well as the self-service in B2B scenarios (which is ticket-ops when doing it with Okta, apparently). Hope this helps.

Thanks for the feedback. That's true it is not a single one indication.

I would argue that times have changed. Sure, there's still misaligned interests between ad providers and users in terms of privacy. But I think the EU regulators found the right level of financial incentives to change some of the worst habits.

Discussing patterns on event-sourcing, cloud-native, and distributed systems with Cockroach Labs.

Love it! Hopefully it takes off as a thing in the second half of pandemic lockdown madness.