Auth0 OSS alternative Ory Kratos now with passwordless and SMS support
An open source release of Ory Kratos, positioned as a component in an Auth0-style stack, adds passwordless logins and SMS-based authentication, prompting debate over security trade-offs and real-world usability. Commenters contrast SMS’s well-documented weaknesses (SIM swapping, SS7 vulnerabilities, account recovery abuse) with its universality and simplicity for non-technical users and certain markets, and note that it remains a de facto requirement in some regulated and enterprise environments. The thread also surfaces comparisons with alternatives like Authentik, Keycloak, FusionAuth, and ZITADEL, plus concerns about deployment complexity and built-in telemetry that phones home by default.
SMS for Authentication & Security Concerns
- Major debate on whether SMS should be supported for auth/MFA.
- Critics argue SMS is insecure due to SIM swapping, SIM cloning, SS7 weaknesses, over-the-air interception, and social engineering of carriers; multiple links to real-world breaches (e.g., major hacks, financial theft, regulator attacks).
- Some say SMS 2FA often degrades into “only factor” because it’s used for password reset and account recovery, creating an additional account takeover path.
- Others argue SMS as a second factor (never for reset, never as sole factor) is still meaningfully better than password-only, especially for non-technical users and regions where phone numbers are the primary identifier.
- There’s concern about number recycling, phone loss, roaming issues, and phone-number churn making SMS brittle as an identifier.
Product Scope, Complexity & Comparisons
- Kratos praised as a powerful, production-ready identity solution with MFA, passwordless, WebAuthn, and now SMS and phone-number-first support.
- Some users find it complex to configure and integrate, especially with custom UIs and jsonnet-based config; maintainers say recent releases and CLI tooling have improved this.
- Comparisons to Auth0, Authentik, Keycloak, Casdoor, Zitadel, FusionAuth, WorkOS, and Stytch:
- Some say Kratos is “only a component” of a full Auth0 alternative unless combined with other Ory services (OAuth2, authZ).
- Others see it as sufficient alone for many app-centric use cases.
- A few prefer alternatives as simpler or better suited for pre-existing apps or B2B/org-specific policies.
B2B SaaS & Multi‑Tenant Use Cases
- Several participants discuss needs like per-organization rules (MFA, password policies), routing by email domain, and SSO to customer IdPs.
- Ory’s “B2B organizations/SSO” feature is mentioned but docs are viewed as thin; advanced configuration may require paid tiers.
Telemetry & Privacy Concerns
- Strong criticism that Kratos “phones home” by default, even when telemetry is disabled, sending minimal version/usage pings with IP.
- Defenders say telemetry is clearly documented, minimal, used for quality and usage insights, and can be disabled or blocked at the network level.
- Some see any non-consensual telemetry as unethical “spyware,” especially in security products; others view this as an overreaction.