Meet the identity platform that makes the login process safe and seamless

Consider the login process. It’s something everyone does on a regular basis for their various online personas. But as end users, they don’t know how much happens behind the scenes when they enter their username and password combo and click the login button. Turns out, a lot goes into making this process smooth and secure.

“I’m not thinking about the mechanics of an application, I’m not thinking about the complex layers of authentication and authorization that go into it – I’m concerned about ‘how do I read my email?’” says Randy Nasson, director of product management at identity authentication platform Auth0, summing up the end-user thought process. Auth0 was acquired by identity platform Okta for US$6.5 billion in May 2021 and is now one of its product units.

But ensuring user identity is a critical part of using any app or website.

Global organizations and communities such as the Internet Engineering Task Force and Open Web Application Security Project set the standards and best practices for internet security, but it’s difficult to execute well, especially with how companies have to handle other priorities in growing their businesses. Additionally, users demand that the login process be a seamless affair – which doesn’t usually correlate with security.

“As a provider, we’re beholden to constantly keep up with the changing state of technology, browsers, and devices so that we can make sure that we’re delivering the most secure and seamless experience possible,” says Nasson.

Solving the issue of identity

Auth0’s story began in 2013 when co-founders Eugenio Pace and Matias Woloski noticed developers’ difficulties in implementing authentication and authorization in their solutions. Both founders had extensive experience in the identity sector and wrote books on claims-based identities, recognizing first-hand the potential for a business focused on simplifying this essential yet tedious factor. Validating their decision were three major shifts in the tech world.

(From L to R) Matias Woloski and Eugenio Pace, Auth0 co-founders / Photo credit: Auth0

First, widespread smartphone usage was pushing the importance of identity security to the forefront, as millions of users suddenly needed to sign in to their devices and software. Second, developers themselves were becoming more empowered, picking the best-in-class solutions for their projects based on programming languages and compatible technology. Finally, with more people going online, password and data breaches were becoming more prevalent.

This combination of factors led to the duo developing a platform combining the best practices and customizability for login processes – which eventually became Auth0.

A rough start

Auth0 had its fair share of growing pains. According to Nasson, although both Pace and Woloski had a clear understanding of the problem they wanted to solve – how to make authentication easy and secure for developers – they didn’t know if it could lead to a viable business. Advisors and investors were unconvinced of their ability to pull off the task, thinking that login security might be better suited for a larger company with an established reputation.

“They persevered through these early days by embracing the idea that they didn’t have all the answers or the credibility, but that they would learn as they proceeded,” explains Nasson. “They started small, earning the trust of one paying customer at a time – along with many hundreds of free developer accounts – until they eventually landed their first enterprise customer, which is still a customer today.”

In addition, the founders were based in different parts of the world, with Eugenio being in Bellevue, Washington while Matias was in Buenos Aires, Argentina. A conscious decision to work remotely turned into a problem as issues with scaling and working across distances came into play.

Imbuing company values to foster collaboration, incremental improvements, and transparency became integral to ensuring the success of a distributed startup. Although most people didn’t work together in an office, establishing camaraderie and trust through these shared values proved to make a difference.

“Like a true startup, everybody was writing code, everybody was acting as salespeople talking to customers,” recounts Nasson. The CEO, Pace, fielded support tickets, and one engineer decided he’d give marketing a try – he eventually became the VP of marketing.

“All these helped everybody realize that we’re all in this together,” adds Nasson. “When you equip your team with the autonomy to reach without the fear of failure, amazing things can happen.”

Focusing on customers

What helped to set Auth0 apart from its competition is the constant communication with its primary customers – developers. Helping the people toiling in the trenches enabled the company to learn the pain points that needed to be addressed to solve and create products that made a difference.

Nasson points to one breakthrough: hosting clients’ login pages on Auth0’s servers. Doing so removed the burden of having to build and maintain a login page from the developer, allowing them to focus on more important parts of their product.

By helping its developer community to solve key problems, Auth0 turned them into champions for its solutions. This, in turn, convinced business executives and brought in larger enterprise clients. The company’s developer ethos and expertise in customer identity and access management was a primary investment thesis for its acquisition by Okta.

“We had to maintain our own identity of being very developer-first and developer-friendly throughout the stage of growth and not just go after the biggest deal at any cost,” adds Nasson.

An example of how Auth0 balances business and developer needs was the implementation of the Sign in with Apple feature. Announced in June 2019, Sign in with Apple allows users to log in to apps and websites with their Apple accounts, eliminating the need to create new usernames and passwords. While the end user enjoys seamless sign-ins across platforms through the feature, processes in the backend were far more complicated.

“We only got word of the feature a few months before it was scheduled to roll out,” shares Nasson. But the importance of implementing Sign in with Apple caught the attention of multiple clients. One customer was pushing particularly hard for integration, and with Auth0 eager to please, “all hands on deck scrambled to deliver this new social connection,” recounts Nasson.

“And we got them there,” he adds. “They were one of the first in the App Store to have [the feature]. Rolling out the integration on time was itself a success, but enabling our customer to meet their business objectives while deepening our relationship and learnings by working directly with their developers was the cherry on top.”

Keeping customers secure

With the increased proliferation of technology across all businesses, many challenges have also popped up. And when identity is added to the mix, security becomes increasingly important to mitigate risks.

“One of the things that has changed, even in just the short time Auth0 has been founded, is the scale at which malicious actors come into play,” says Nasson. Due to the relative ease and low cost of executing brute force attacks, clients can face distributed denial-of-service attempts daily. In some cases, Nasson reveals, up to 40% of login requests could be from malicious actors trying to penetrate systems.

Randy Nasson, director of product management at Auth0 / Photo credit: Auth0

To handle these challenges, Auth0 and Okta make sure to be in consistent contact with standards bodies, analysts, developers, customers, identity, and security industry peers and experts, keeping the companies up to date with the latest technologies and countermeasures.

“We have entire teams that are dedicated to understanding the ever-evolving protocols and platforms, which is why we advise companies not to build identity themselves or think of this as a point-in-time solution. This is very, very hard stuff,” says Nasson.

Logging in without passwords

Looking forward, Nasson thinks that ascertaining identity will become even more seamless.

“We’re already in a state where continuous and contextual information is going to be used to automatically authenticate users,” he says. This means that once a user creates an account, they may never have to explicitly log in again.

Instead of repeatedly asking users to provide their password to log in, applications can maintain user access over prolonged periods of time by continually assessing multiple risk factors – such as geographic location and frequency of activity – that can be used to determine if something out of the ordinary is happening. This delivers frictionless access to trusted users while providing security from bad actors.

Biometric logins with a user’s face or thumbprint could be more widely used, along with other methods of passwordless authentications.

No matter how the future plays out, Nasson believes that Okta and Auth0’s dedication to keeping their finger on the pulse with regards to client needs and industry developments is what will keep their businesses ahead of the game.

“We’re not shy about engaging with anybody. We talk to our customers on a regular basis. We talk to analysts, we talk to adjacent companies, people we connect with on Twitter or LinkedIn,” he says. “We’re constantly out there, because we know that the best information and guidance emerges when you take the time to talk to people and understand what it is they’re trying to do.”

Auth0 is a product unit within Okta that solves complex and large-scale customer identity use cases for global enterprises with its extensible and easy-to-integrate platform. Safeguarding billions of login transactions each month, Auth0 delivers convenience, privacy, and security so customers can focus on innovation.

Find out more about the firm on its website.

This content was produced by Tech in Asia Studios, which connects brands with Asia’s tech community. Learn more about partnering with Tech in Asia Studios.