Aliyah Winfrey

I'm Aliyah Winfrey, a staff design researcher who’s passionate about creating clarity and alignment in complex research spaces. I thrive on asking the right questions and uncovering insights that drive meaningful design. Outside work, I tend to my garden, experiment with new baking recipes, or get lost in a classic PS2 game.

Staff Design Researcher

Exploring the evolving tech/identifier trends, needs, and behaviors of a global audience

As an advocate for developers and a company that trusts the developer community, we are open-sourcing this survey data to foster dialogue, innovation, and shared learning. By making these insights publicly available, we invite researchers, developers, and CIAM leaders to analyze and build upon our findings. Understanding global digital identity trends requires diverse perspectives, and an open-source approach allows for an informed and equitable discussion. 

Digital technologies continue to change human interactions, shaping global attitudes toward identity, security, and new technological innovations in similar and different ways. Our latest End-User Device & Login Sentiment survey highlights key trends in digital identity preferences, authentication methods, and security concerns. This survey and high-level takeaways contribute to the broader discourse of technology, CIAM, and an evolving general population market. Please find details on the purpose, audience, and collection below:

## Purpose

Understand the general population of global users' evolving technology needs and behaviors to identify key trends and shifts. The following Key topics were covered: 

**Device/OS usage**

* Personal vs. Work device usage 
* Device registration preference
* Work application usage

**Attitude towards technology**

* Overall tech familiarity 
* Hardware update motives
* Frequency of technology updates

**Identifier preference**

* Identifier familiarity 
* Identifier registration preference
* Perceived vulnerability and convenience 

**Password management**

* Reuse & Change Password
* Compromised PII
* Fraud Check

![Key Topics](https://images.ctfassets.net/23aumh6u8s0i/34N68QuL8Q9JZBT8ql8wXB/218ff72b8716be2887562adb892c3e28/key_topics.png)

### Research Questions

1. Understand current technology devices and usage patterns 
2. Identifying emerging trends in end-user preference 
3. Discover unmet needs and pain points to capitalize on new opportunities, driving innovation and strategic growth

### Target Audience

Partnered with Qualtrics for a 33-question survey in the following regions/countries: EMEA (France & United Kingdom), NAMR (United States & Canada), LATAM (Mexico & Brazil), and India. 

### Sample

**N=1049**

* Age
 * Age 18-23: 19%
 * Age 24-30 19%
 * Age 35-54: 32%
 * Age 55+: 30%
* Region
 * NAMR 25%
 * EMEA 25%
 * LATAM 25%
 * APAC 25%
* Gender
 * Male:48%
 * Female: 52%
* Community Type
 * 1/3 Rural
 * 1/3 Suburban
 * 1/3 Urban
* Household Income
 * Less than $25,000- 5%
 * $25,001 - $50,000- 10%
 * $50,001 - $75,000- 20%
 * $75,001 - $100,000- 30%
 * $100,001 - $150,000- 20%
 * $150,001 - $200,000- 10%
 * More than $200,000- 5%

### Data Integrity 

No personally identifying information (PII) was collected. All responses shorter than 3 minutes (180 seconds) were removed. The median completion time was 6.08 minutes. Participants were compensated for completing the survey. 

Samplings across regions are representative of age and gender distributions. For example, given the larger youth population, more youth aged 18 to 30 were sampled in India. Given the country's demographics, ages ranging from 45 to 59+ were skewed towards EMEA and NAMR. 

Additionally, LATAM skewed predominantly toward the urban community type, EMEA represented much of the rural community type, and NAMR led heavily toward the Suburban community type.

### Regression analysis

![Regression analysis](https://images.ctfassets.net/23aumh6u8s0i/2cF18Iz0eEWlprYHPlHlFR/f21d36a8cb21cabedd6100f1037f7aba/Regression_analysis.png)
_Logistic Regression on survey data was completed to gauge if any response options forecast an individual's Willingness to Try New Identifiers. No substantial evidence indicates these factors are significant predictors._

 
Six low-level predictors for Willingness to Try New Identifiers were identified. These include the following:

1. Attitude towards New Tech
2. Familiarity with Identifiers other than Email and Username
3. How often do individuals update their devices
4. Age
5. Apple-Only OS Owners
6. APAC/India region 

Data was collected in October of 2024. Data is accessible via a[ CSV. file](https://cdn.auth0.com/blog/blog/End-User-Sentiments-Survey.csv).

#### Citation

1 End-User Device and Login Sentiment, Auth0, 2024. [Link](https://auth0.com/blog/digital-identity-what-users-think-about-devices-and-logins/)

## Insights

### Top 10 Learnings 

1. Android Phone and Windows OS more widely adopted across diverse groups: 
 - Adoption more prevalent in LATAM and APAC
 - Android users tend to be lower to middle-household income 
![Android, Windows OS lead in adoption](https://images.ctfassets.net/23aumh6u8s0i/1cz14tdcdDmqEZI5ZBgD9M/15021e7a00fe7d4967d9255f16f99b7d/Screenshot_2025-03-21_at_12.39.11_PM.png)
2. Younger demographics and higher income are more likely to use Apple OS 
 - Apple OS more pronounced in EMEA and NAMR
3. Younger demographics and higher income are more likely to use Apple OS 
 - Positive attitude toward new technology, higher frequency of device updates, and more open to adopting new identifiers
4. EMEA and NAMR are more cautious about approaching new technologies 
 - Preference could be influenced by cultural differences and regulations
![General comfortability with adopting tech once mainstream](https://images.ctfassets.net/23aumh6u8s0i/6LXzCLV1QzEPUbZk2rh5c9/33bea12287c85db2359d9e8990a5bda4/Screenshot_2025-03-21_at_12.29.28_PM.png)
5. Top upgrade motivators are new features, device damage, battery issues, and limited memory. 
 - India/APAC unique concern for social brand preference and security concerns
![New features and de ice damage lead us upgrade motivators](https://images.ctfassets.net/23aumh6u8s0i/7CbnGFomOPj6PfmU4IfzeD/e92edbcce72f7994c1ca55ac4575dfa8/Screenshot_2025-03-21_at_12.30.33_PM.png)
6. Respondents who are more familiar with alternative identifiers (email and username) show higher readiness to adopt new ones. 
 - Apple OS users less likely to try new identifiers 
7. The most familiar and used identifiers include Email, username, phone/SMS, and biometrics. In contrast, the least used and familiar include Blockchain and hardware security keys. 
 - Social login is slightly more prevalent in LATAM and APAC
![APAC lead in familiarity and use for most methods](https://images.ctfassets.net/23aumh6u8s0i/71S0j1xEeG6isV67O1SwkP/4a7cdda42233bd8cc16c2a6a2f5829cf/Screenshot_2025-03-21_at_12.35.26_PM.png)
8. Username, email, and fingerprint are rated as the most convenient across all regions. 
 - EMEA and NAMR seem to be more sensitive to non-conventional identifiers such as government ID, security key, and voice ID, while even social login is ranked neutral. 
![Username, email, and fingerprint rated as most convenient](https://images.ctfassets.net/23aumh6u8s0i/7JSF843aMWSNsNSTxBBF0d/c1e9723a8b0efd52cc02748b81256bf6/Screenshot_2025-03-21_at_12.36.02_PM.png)
9. In contrast, Social Login is perceived as the most vulnerable to hackers and cyber-attacks. 
 - Our recent article, Demystifying Social Login, dives deeper into the security of leveraging Auth0 social connections for end-users. 
![Social Login seen as most vulnerable to cyberattacks](https://images.ctfassets.net/23aumh6u8s0i/7zuPvErvRjmZo3uflHsRdG/49f35a40cc73261e8d7ad06cffba6f8b/Screenshot_2024-12-17_at_10.27.55_AM.png)
10. Security and Privacy priority for motivations to try new identifiers 
 - NAMR and EMEA rank innovation as one of the lowest drivers
![Security and Privacy priority for motivations to try new identifiers](https://images.ctfassets.net/23aumh6u8s0i/3LpGrqWztktMy8Nw1H2lYJ/550ad822c4f8684ef18c2cea1f751d56/Screenshot_2025-03-21_at_12.34.25_PM.png)

> Download the [.CSV data here](https://cdn.auth0.com/blog/blog/End-User-Sentiments-Survey.csv).

Join the conversation! Share your thoughts, repost, and tag us to discuss the future of digital identity.

Digital Identity: What Users Think About Devices and Logins

Elizabeth de Moll

As an engineering manager, Elizabeth de Moll builds teams and drives the execution of feature delivery. Though she began her career as a lawyer, please don’t hold that against her. She is passionate about engineering leadership, supporting women in tech, and coaching engineers.

Manager, Engineering

March of 2023 rolled around much like any other March at an enterprise tech company. Purple heart emojis popped up across Slack messages, and the usual statements were made about the importance of Women’s History Month. Vice President of Engineering Monica Bajaj wanted this year’s Women’s History Month to be different. She wanted the folks engaged in our Women in Engineering group and the larger Women at Okta community to [take action and make history ours](https://auth0.com/blog/women-s-history-month-women-in-engineering/). Inspired by Monica’s call to action, I’m sharing my own experience as a woman in tech, hoping the story will resonate with others and inspire even one other person.

My story of being a woman in tech begins with the story of another woman - my mother. My mother graduated from law school in the 1970s. She became a lawyer at a time when less than 12% of all lawyers in the United States were women, at a time when my grandfather warned her not to learn how to type for fear she would be relegated to a secretarial role, and at a time when women were expected to wear skirts and heels to work each day. My mother hustled and overcame the odds to eventually become a Vice President at Citibank in the 1980s, a roundabout way of saying my mother was –and still is – a badass.

Fast forward to 2015, and I graduated from law school. That’s right! I once dabbled with the dark side and practiced law. Jokes aside, though it wasn’t the right field for me, I have nothing but admiration for the many wonderful lawyers I know, including the incredible corporate legal team who needed to proofread this blog for publication! I graduated at a time when just under 40% of lawyers in the United States were women, which is a huge leap from 40+ years prior when my mother graduated. My mother was thrilled, and I remember us both feeling so proud of the progress and representation of women in the legal field. The world was changing! Opportunities were increasingly available to women! Surely, this progressive and inclusive mindset must be expanding across every field - right?

I quickly learned this wasn't the case when I switched fields from law to software engineering. Only around 20% of software engineers in the United States are women. Out of a cohort of forty students, I was one of eight women in my coding boot camp. Only three of us are still software engineers today. A recent study showed that [50% of women leave their careers in tech by the age of thirty-five](https://www.fastcompany.com/90975256/women-hold-just-27-of-tech-jobs-here-are-5-research-backed-potential-solutions). This rate is 45% higher than the rate at which men leave their careers in tech. Many assume this career cliff has to do with women reprioritizing and focusing on their families, but often, the reason many women abandon their careers in tech at this staggering rate is because of how hard it is to be the “only.”

From the day I stepped into coding boot camp to today as an experienced engineering manager at a well-known and progressive corporation, I’ve experienced being the “only” in a meeting, on a team, and even in an entire department more times than I can count. Being the “only” can be isolating, but over time, I've learned many lessons and implemented the following strategies to help alleviate loneliness, build connections, and foster community.

## Connect with Your Peers

While being the “only” or even being one of a few can be challenging, it’s important to remember that you’re not alone, and the best way to do this is to connect with your peers. At Okta, we are fortunate to have the largest, most incredible, and most talented pool of women engineers I’ve encountered in my career, which provides an amazing network to tap into right at work. Being part of our Women in Engineering group means you can hang out at WinE Time on Fridays, listen to cool technical talks or reach out to your fellow women engineers with one-on-one coffee chats. By joining WOkta (Women of Okta), you get the same fellowship and the chance to engage beyond the engineering bubble. Outside of Okta, there are local women's engineering groups or women in tech groups in many locations for you to connect with in person. Personally, I’m a big fan of [Women Who Code](https://www.womenwhocode.com/). From panels on The Danger of Burn Out to Advocating for Yourself, I’ve always felt seen and incredibly uplifted after attending Women Who Code events. However you choose to connect, finding a group that speaks to you is important. 

## Make Peace with Imposter Syndrome

I’m going to say the thing no one struggling with imposter syndrome wants to hear: imposter syndrome never goes away. There will always be a little voice questioning if you’re qualified enough or flat-out trying to convince yourself that you’re not. The most important thing you can do is make peace with that voice. First, recognize that imposter syndrome tends to rear its ugly head most when you’re doing something new and scary. If you’re feeling its effect, you’re probably pushing yourself outside your comfort zone, becoming even more awesome than you already are. Use it as a sign that you are heading down the right path. Second, practice telling that voice to “Shut up.” It doesn’t know you or the amazing things you’re capable of. You’re a woman in tech! Just by doing what you do daily, you defy the odds. That voice will get quieter with practice. Third, it’s not enough to neutralize that negative voice; you must practice the positive. You have to do whatever you need to get into a headspace where you believe you can do all the things. For me, this usually involves a ten-minute dance party in my office to psych myself up. (Thankfully, I work from home.) For you, it may be the same (we should have a dance party sometime), or it may be reviewing all the accomplishments you kept track of in your brag sheet. For others, it may be picturing where they see themselves in five years and feeling excited that this next opportunity will help them get there. Whatever action gets you telling yourself, “I can do this!” is the one you should incorporate into your routine.

## Find a Sponsor

As women, we get a lot of advice about having mentors and the importance of mentorship in our careers, but we don’t often hear about the importance of having a sponsor. Mentorship is important, and I encourage everyone to develop a mentorship. What does developing a great mentorship look like? It can be as simple as setting up recurring one-on-one meetings, having “coffee chats,” getting their feedback on your pull requests, or getting vulnerable and asking for advice. Let me share the worst-kept secret: people love being asked for their advice, so don’t feel awkward about being the first to reach out. Also, great mentor relationships can last a lifetime, and you’re not limited to just one. Having multiple mentors with expertise in different areas can help round out your personal and career growth.

So, where do sponsors fit in? Studies show that mentorship can look quite different for men and women. Women often get advice on how they should change, while men tend to get concrete steps they should take to advance their careers. A sponsor uses their power and influence to advocate for you. Everyone reading this, women and men, should find a sponsor (or multiple sponsors). You need someone who will say your name in the rooms you aren’t in yet –someone who knows your value and will help open doors for you. Don’t think that your work alone will do the talking for you or that having a sponsor means you somehow achieved less on your own. Think of it as the professional “alley-oop” we all need to get ahead. No one has to go it alone.

## Find Your Person

Yes, joining peer groups is wonderful, and ideally, we’d all tell our imposter syndrome to take a hike, but for days where those tactics aren’t enough, find your person. What do I mean by your person? Find that other woman in tech who doubles as your personal hype-woman, who will help build you up when self-doubt creeps in, and who will give you that ultimate confidence boost you need to succeed — the one who will proofread your Slack messages and will sit through practice rounds of your big presentation. Don’t ever feel like you need to be strong alone. 

## Pay it Forward

I was fortunate enough to be inspired by another woman in tech to become a software engineer. She guided me and, most importantly, helped me build the confidence to embark on a journey that would change the entire trajectory of my career. When I doubted myself and my abilities, she gave me the encouragement I needed to keep going. I owe her so much that I will never be able to pay back. What I can do is pay it forward. You don’t need to change the landscape of women in tech overnight. Just try your best to make the experience better in any way you can for someone else: share your experiences, become a mentor, set up that coffee chat, and elevate each other’s voices. In short, take action! This support is the secret sauce. This fellowship is how we get more women to join tech and stay for the long haul.

When my mother and I celebrated the higher number of women practicing law, that number didn’t improve by happenstance. It got better because of trailblazing women like my mother, women who didn’t let the odds intimidate them and who showed up ready to do the work every day while supporting those around them. We can do the same thing within tech. Together, we, the amazing women here at Okta and our incredible allies, can have the same impact and improve the representation and experiences of women in tech. There’s no better time to start than today.

We’ve built an amazing community here at Okta; we’d love for you to join us! Check out the [Careers Page](https://www.okta.com/company/careers/) to learn more about our current opportunities.

An Open Letter to Women in Tech

mimi-chakravorti

I help define the Okta brand and bring it to life. I’m a part of the Brand Team within the Studio that works on brand strategy, naming, brand management, brand messaging and research. I am excited to help build our brand that not only reflects who we are today, but also helps us define our future.
 
I’ve spent most of my career helping some of the world’s biggest companies create their brands and tell their stories. Having done stints in advertising, research and media, most recently I was at Landor & Fitch, a leading global branding agency.
 
I’m a San Francisco Bay Area native and have lived in London and New York before finding my way back to the East Bay- Lafayette, to be exact. When I’m not working, I'm most likely running after my two young kids.

VP, Brand - The Studio - The Studio

Mimi Chakravorti

Since Okta acquired Auth0 in 2021, we’ve been continually aligning and integrating our teams and technologies.

Today, we’re excited to introduce the new icon and wordmark for **Auth0 by Okta!** We believe the new icon better reflects Okta’s strategy and the relationship between Workforce Identity Cloud, Customer Identity Cloud, and the Auth0 platform. 

Read on to learn a bit about the meaning behind it.

## Why the Change?

First, let’s call out what is not changing — we have not changed any URLs, APIs, or code libraries. “Auth0 by Okta” is still the same platform you know and love, and the Auth0 name remains.

With the new wordmark and icon, we reflect how the Auth0 technology is an integral part of Okta’s success and strategy. These updates evolve the Auth0 by Okta logo and wordmark to feel like part of the Okta brand family, using the Okta font and rounded shapes.

This new icon brings Auth0’s heritage forward into its place as a foundational technology of Okta and its flagship product line — Okta Customer Identity Cloud.

## New Wordmark and Icons

![New Wordmark and Icons](https://images.ctfassets.net/23aumh6u8s0i/5jPPy94Y0qylVsZeWWWKYe/65e9aa6d49e931cbc874a90886238eca/new-brand.jpg)

As a reminder of our structure, here’s how to look at it:

* **“Okta”** is one company — The World’s Identity Company.
* **“Okta Workforce Identity Cloud” **is our flagship IAM offering. Its icon alludes to the way you can bring together disparate technologies that enable your people to do their best work, all while creating a safe perimeter.
* **“Okta Customer Identity Cloud, powered by Auth0” **is our flagship CIAM offering. Its icon is an evolution of the Auth0 logo and alludes to the way you can bring together amazing experiences that are personalized to the individual, all while protecting their Identity. It carries the Okta brand promise of enterprise-level scale, support, and expertise.
* **“Auth0 by Okta”** is the technology that powers Customer Identity Cloud. Developers will continue to see this name in the code and APIs, as well as developer resources and tooling. We use the same icon as Customer Identity Cloud.

Note: Because Customer Identity Cloud and Auth0 by Okta are the same technology, you’ll likely encounter both names.

## What to Expect

You’ll notice changes to display names and icons throughout the experience and in communications. As we update things over the coming months, you may encounter both the old and new visuals. We appreciate your patience as we change these elements on a rolling basis.

## What You Need to Do

If you’re a customer, you do not need to do anything. There won’t be any interruptions to services based on these changes.
If you’re a partner who needs these icons to update your co-marketing materials, please contact [partners@okta.com](mailto:partners@okta.com).

Branding Updates

Ian Hassard

Senior Director, Product Management

Tianyi Qian

I’m a UX Researcher at Auth0. I’m passionate about human behaviors and technology. With a foundation in sociology, I enjoy the process of using research to understand user needs and drive product and design decisions. I enjoy sketching, reading, and indoor climbing!

UX Researcher

Challenging our assumptions around how usability drives modern identity technology adoption

We’re obviously really passionate about identity. Businesses are excited about the potential user experience (UX) and security benefits of modern identity technologies. But what do consumers think?

To gain a better understanding of public attitudes to modern identity, Okta surveyed consumers about their experiences with new authentication options, their enthusiasm for passwordless alternatives, and their existing password security habits. 

## Methodology and Motivation

Before we explore the results, it’s worth talking about _why_ Okta surveyed individual consumers. After all, Okta doesn’t sell technology directly to the public. Our customers are businesses, governments, and nonprofits. 

It’s a valid question. Here’s the answer: individuals ultimately use our products, whether they’re consumers interacting with the Okta Customer Identity Cloud (CIC) or employees using Okta’s workforce solutions. 

Okta wants to protect the digital economy. But to do that, we need to build products that consumers actually want to use. We need to build something that’s meaningfully better than legacy password-based authentication. 

This means we need to test our assumptions about consumer attitudes. We must understand their needs, preferences, and habits. 

By speaking directly to consumers, we can learn their likes and dislikes. We can measure their exposure to modern identity technologies and see which ones they enjoy using. By delivering products that align with the needs of consumers and employees alike, we can start transitioning away from passwords and move towards a more secure future. 

So, let’s talk about methodology. Okta’s Customer Identity Cloud Unit (CICPU) conducted a series of 60-minute Zoom research sessions with consumers from around the globe. These sessions consisted of two parts. 

The first was a discussion about authentication preferences and their attitudes to password security. We asked about their best and worst authentication experiences, as well as their exposure to modern identity technologies. 

The second section consisted of a usability test. Participants were asked to create new accounts on a number of platforms using a variety of modern identity approaches and asked about their likes and dislikes. 

We spoke to 23 participants in total, with those from the Americas representing more than half (55.2%). EMEA and APAC participants accounted for 30.4% and 17.4% respectively. 

Our study didn’t have the largest sample size, but that was by design. We weren’t interested in doing a quantitative study, where we looked at habits in aggregate. Our research was qualitative. We wanted to see the nuances and opinions that aren’t easily identified at scale. 

![Security](https://images.ctfassets.net/23aumh6u8s0i/3X31s04spm3rcZHMbsjkli/3d974e2b7075f5c5ffc3cf4c37fe4f89/adaptive-mfa-sep2)

## Meet The Consumers

Our respondents came from a diverse array of backgrounds. They represented ten different industries, ranging from retail and manufacturing to education and healthcare. All reported a strong level of confidence with technology, with 60.9% claiming to be “very” tech-savvy and 39.1% describing themselves as “somewhat” tech-savvy. 

Despite a high level of self-described tech savviness, the overwhelming majority of respondents failed to adhere to password security best practices. Few reported using a non-browser-based password manager, like 1Password or LastPass. Most said they reuse passwords across devices or apps. 

But there was some nuance. Just because they didn’t necessarily use perfect password hygiene doesn’t mean they were totally unaware of the risks they faced or had no wish to improve.

Many claimed to use separate passwords for their most sensitive accounts, such as with banking or healthcare applications. Some stored their passwords in spreadsheets or in their phone’s Notes app. 

Although this is vastly less secure than using an encrypted password vault, it’s arguably better than re-using potentially weak and compromised passwords. And it indicates an awareness of the risks associated with account compromise and a willingness to improve their security. 

Many of the interviewees described this as a “headache” but weren’t actively looking for alternatives, as they didn’t know where to start. 

## Consumer Attitudes to Identity and Authentication 

During the second phase of the interview, CICPU asked our interviewees to create accounts for a variety of platforms and sign-in with their credentials. These included the social websites Twitter and TikTok, the Washington Post, and Airbnb.

Curiously, the attitudes of our panel were often shaped by how well they trusted a particular company and the general usability of the site in question. 

TikTok was a good example of this. Although TikTok is the fastest-growing social media platform in the world, with over 1bn monthly active users, it’s also embroiled in controversy. The company’s Chinese ownership has invited scrutiny from lawmakers on both sides of the Atlantic, with some leading calls for the app to be banned. 

For many of our participants, their authentication choices were informed by what would share the least amount of personal information rather than security or convenience. 

They increasingly opted to use their phone number or an email address rather than social login options, which may reveal their personal info on other platforms. They believed doing so would limit the amount of personal information a platform like TikTok could obtain.

TikTok offers a wide range of sign-in options (although slightly fewer for registering). But this wasn’t necessarily a net benefit, according to our participants, who felt they added to a cluttered and confusing user experience. 

Our research highlighted other UX shortcomings within TikTok, which lengthened the time required to access the app for many participants. These included the placement of the form fields used to input the one-time password (OTP) code generated when using multi-factor authentication (MFA). Additionally, many participants faced difficulties in understanding where to look for the OTP code.

TikTok had the second-highest sign-in failure rate (33.33%) and the highest sign-up failure rate (38.89%). It also had the longest login completion time (69.09s) and the second-longest sign-up completion times. 

By contrast, the Washington Post had the lowest failure rates across login and account creation flow (7.14% and 5.56%, respectively) and the quickest completion times. It also offered the most popular identity experience of the sites studied. 

So, what’s the secret sauce behind the Washington Post’s success? In short, it’s among the simplest experiences of those surveyed. The Washington Post also required comparatively less information when compared to the registration flows of other sites. 

It’s worth noting that the Washington Post also allows users to authenticate with a one-time “magic link” sent to their email accounts. Our participants overwhelmingly described this as “unnecessary,” as it required additional steps to complete and broke the login flow, with participants opening another page to sign-in.

The context was an unavoidable factor in how our panel chose which identity technologies to use. In the case of Airbnb, the majority of our respondents chose to use their phone number and email address as they were eager to maintain visibility over their bookings. 

## The Factors Driving Authentication Choice

This exercise wasn’t merely about seeing how individuals felt about certain websites’ authentication flows. It exposed our participants to a variety of authentication methods. We could observe which they preferred and which ones they avoided and learn the reasons why they chose the options they did. 

The factors that influence a person’s decision to use a particular authentication technology are multifaceted. They include things like trust, context, and familiarity.

In every website tested, email consistently ranked as one of the top-two authentication methods among our panel. In many respects, this didn’t come as a surprise. It’s something everyone is familiar with. Old habits die hard. 

From a technologist's perspective, email and password-based authentication feel archaic. It’s a method that’s vulnerable to things like credential stuffing and phishing. Our participants, however, saw it as a tool to protect their privacy from organizations they didn’t fully trust. 

Many expressed the belief that email-based authentication limits the amount of personal data shared with a website, especially when compared with other modern methods, like social login. Others avoided using social login and expressed fears about a potential contagion effect, where if one website finds itself compromised, the attacker would be able to access their data on other websites. 

In practice, things are a bit nuanced. These fears, while understandable, don’t reflect the reality of how modern authentication works and how it can protect user privacy and account security. This research illustrates the urgent need for the identity industry — of which Okta is a leading member — to educate the wider public about the relative security of the various authentication methods currently available.

Things are equally interesting when you look at the methods our participants opted not to use. Few, when presented with the opportunity, chose to use “magic links” or QR codes. When asked why, they said it was because they were unfamiliar with them. This is true especially during sign-in when participants want the process to be as seamless and as quick as possible. For many, spending time learning modern/new login options during sign-in is a luxury. 

Naturally, people are inclined to use things they understand over things they don’t. While the adoption of less-common authentication technologies may grow organically, driven by developer and business adoption, it’s not unreasonable to think that education may accelerate this process.

Finally, let’s touch upon the context element. As our interviews showed, people’s choice of authentication technology is heavily influenced by the website or platform they’re using. 

A significant number of participants said they used more secure authentication methods (with biometrics and multi-factor authentication cited as examples) when accessing websites and applications that house sensitive personal information. These include government websites and banking applications. 

This finding is heartening. It illustrates a level of understanding about how some authentication methods are more secure than others and a willingness to adjust their behavior based on the sensitivity of the application. 

![security](https://images.ctfassets.net/23aumh6u8s0i/40V8USPBHCJ0K9SxZHISMw/b7488bb599ce8d9f83a3aeea0e4334fa/adaptive-mfa-sep1)

## Key Takeaways

Our study leaves a lot to consider. Here are our biggest takeaways: 

* Modern identity can improve UX, but if the UX foundations are infirm, it might confound users. A great example is TikTok, which offers a myriad of authentication choices, leaving consumers unclear about what to do. 
* If it ain’t broke, don’t fix it. The Washington Post offers an incredibly fluid authentication and account creation experience, leaving other identity tools looking superfluous in the eyes of consumers. There’s a question to be asked about “diminishing identity returns,” but that’s for another article. 
* People want to do the right thing when it comes to password best practices and hygiene, but they often choose convenience over security. While their execution is sometimes lacking (with reused passwords stored in spreadsheets and notes), their heart is in the right place. 
* The way consumers authenticate is driven partially by the trust. UX is an important factor, certainly, but it’s not the only one. 

We’ve long argued that the human element is among the most important in a business’ security posture. Your safety depends on your customers and employees making the right choice. We can make that choice easier by offering a better UX, but we also need to understand their preferences and fears. We need to understand why people make certain choices. 

This study is, we hope, an important step in understanding that human element. Choices are, by definition, contextual. A myriad of factors influences them, ranging from the UX composition of a website to the customer’s sentiment toward an organization.

Ultimately, when it comes to identity, there’s no such thing as a “one-size-fits-all” solution. And if you want to learn about how Okta can deliver an identity solution tailored to your organization’s unique needs, reach out to the team here.

Understanding Consumer Attitudes Towards Modern Identity

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

"Passkey" is the shorthand for FIDO multi-device credentials, a new technology that makes it convenient to use FIDO's phishing-resistant authentication methods and ceremonies across multiple devices.

Our Take on Passkeys

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

Auth0's CPO discusses the importance of the product unit's technical hub in Spain

With the recent [1-year anniversary](https://www.okta.com/blog/2022/05/raising-the-bar-on-identity-one-year-of-okta-auth0/) of Okta and Auth0 coming together, it has been exciting to see us growing stronger as one company, united in our commitment to innovating for our customers around the world. We are accelerating our global development and continue to seek ways to get closer to our customers. Combined, we have 24 offices in 16 countries around the world, including our recently-announced international [hub in Dublin](https://www.okta.com/uk/blog/2022/03/growing-our-presence-in-europe-welcome-to-oktas-new-hub-in-dublin/).

In addition to Dublin, I am excited to reveal the opening of Okta's Barcelona office. The office serves as a location where teams can come together to collaborate and create. Auth0's remote-centric DNA, coupled with Okta's [dynamic work](https://www.okta.com/dynamic-work/) framework for hybrid work, lay the foundation for building out worldwide spaces that foster innovation and culture.

Last year, I talked about [Auth0's focus on recruitment in Spain](https://auth0.com/blog/auth0-is-hiring-in-spain-and-canada/). Since then, we have been working to build a world-class technical and product delivery team, drawing from the rich technical talent pool across Southern Europe. 

![Barcelona Office](https://images.ctfassets.net/23aumh6u8s0i/7D9WDUDDws6AAtcc9Q8ZLq/3d28f0155cfea66018f46d4737c92c20/barcelona_office_01.jpeg)

In Spain, over the past year, more than 20 engineers have joined Auth0's established regional teams in data protection and security, product management, software, and data engineering, and platform operations. This highly skilled organization has an impressive list of successes, including the development of financial, data protection, security, and developer support services.

There are many [new opportunities](https://www.okta.com/es/barcelona-office/) to join our technical teams based in Spain or elsewhere in the world and help engineer the future of identity. We intend to add a range of new positions across our technology and field organizations this year. Europe has always been a valued source of technical talent, building on Auth0's rich legacy of teamwork and collaboration across the region. 

Ongoing investment in our technology teams enables us to continue doing what we do best: innovate for our developer community and customers around the globe by bringing best-in-class products to market. Moving forward, harnessing the best technical talent worldwide and developing our international operations remain top priorities for us.

<include src="asides/AboutAuth0" />

Announcing the Opening of Our Barcelona Office

Brittney

Brittney Liburd has been helping teams go to market with SaaS and security technologies for over 12 years. An avid researcher and writer, Brittney has a passion for artificial intelligence, machine learning, and the #goodIDmovement. She also has a near-encyclopedic knowledge of George RR Martin's “ A Song of Ice and Fire” book series.

Sr. Product Marketing Manager at authID

Brittney Liburd

Advanced facial biometrics can enhance Auth0 MFA workflows to provide secure authentication experiences that simplify common challenges for technical roles.

On a daily basis, CIAM professionals battle data breaches, account compromise, ransomware, and fraud. In 2021, digital fraud rates increased 22%, ransomware rates increased 62%, data breach rates increased 17%, — and cybercriminals shifted to softer targets with more valuable data and motivation for ransom payout. Huge shifts in remote work, distance learning, telemedicine, and BYOD trends also added layers of complexity as organizations struggled to protect systems and data.  

These trends illustrate the complex CIAM challenges facing technical roles in B2B, B2C, and B2E environments. Developers, engineers, systems architects who are responsible for CIAM and fraud prevention will find this post most valuable, as we will discuss how facial biometric authentication can strengthen identity assurance while simplifying challenges in implementation, operations costs, security needs, and CX expectations.  

## Facial Biometric Authentication

> Facial Biometric Authentication can help technical roles secure enterprise assets while simplifying the user experience.

Finding the right balance between user convenience, privacy, and security is today’s biggest challenge for developers. CIAM is a convergence of IAM, fraud detection, and authentication tools that are used for controlling user access by both internal users (your workforce) and external users (your customers). However, according to Gartner, no single tool can deliver on all the identity administration, fraud detection, access management, content management, and analytics needed to build out a holistic solution.

As a result, technical roles are left cobbling together solutions that may leave gaps in security or may increase friction in user experience that requires additional investment to remedy. Advanced facial biometric authentication seamlessly woven into the Auth0 login workflow can provide the needed balance between a frictionless user experience and protection against password-related fraud, phishing, and account takeover. 

## 4 Ways to Leverage Auth0 and Advanced Facial Biometric Authentication to Strengthen CIAM

Auth0 simplifies biometric multi-factor authentication for the technical teams responsible for implementing CIAM strategies and tools. This simplification is delivered in four main areas.  

* Easy Implementation with Broad Solution Support
* Operational Efficiency and Cost Reduction 
* Improved Security and Fraud Reduction  
* Enhanced User Experience 

### Easy Implementation with Broad Solution Support

Users today shop, play and work using a broad range of mobile devices and desktop computers, and operating systems. So technical roles need a strong authentication solution that is device-agnostic and capable of supporting everyone interacting with your platform. Biometric authentication that offers portability without being tied to a specific device, an authenticator fob, or an authenticator app also provides the right balance between enhanced platform security and increased user satisfaction and adoption.

### Operational Efficiency and Cost Reduction

Operational inefficiencies caused by complex authentication experiences impact customer loyalty and workforce productivity, with negative impacts on revenue and profits as businesses move slower and customers are lost. B2B, B2C, and B2E focused organizations using Auth0 can improve operational efficiencies and reduce related costs with authentication solutions that are applicable for many use cases across multiple devices. To simplify CIAM for technical roles - focus on finding a solution for user authentication that can serve internal, external, and developer use cases. Facial biometrics can support authentication use cases, including online or mobile app login, chat or call center support, as well as strong authentication for valued transactions and account activity. Also, remember solutions that require complex maintenance should be avoided in lieu of a solution that simplifies administration requires no additional hardware, training, or mental burden on behalf of the user. 

### Improved Security and Fraud Reduction

Advanced facial biometric authentication reduces the risk of account misuse and takeover by requiring the live face of a registered user as a factor for authentication and a condition for access. Even in the event of password or credential compromise, advanced facial biometrics will stop unauthorized access from occurring. Facial biometric multi-factor authentication addresses many fraud-related concerns, including the ability to stop account takeover and quickly authenticate the validity of transactions flagged for manual review. 

### Enhanced User Experience

Including advanced facial biometrics as a factor for authentication within your Auth0 workflow delivers a sophisticated digital experience by balancing strong authentication with customer expectations of low friction authentication and easy access. Today’s users—whether they are shopping, working, or banking – sitting on the train or at their desks are demanding portability with less friction. Advanced biometric authentication eases the user burden as there is no need to download additional software or employ multiple devices for authentication. 

## Conclusion

When evaluating CIAM tools to reduce friction in or further secure your MFA workflow, consider Verified CloudConnect—the ideal bolt-on integration for Auth0. Verified™ CloudConnect delivers fortified, in-browser biometric authentication—supported across all mobile and desktop devices used to access enterprise data and resources. At login or for any transaction you deem to require additional identity assurance, the Verified browser-based UX adds an additional factor of authentication – a live selfie. Verified analysis of the selfie in real-time for biometric matching and liveness, defending user accounts from deep fakes and other spoofing attempts. 

Verified CloudConnect is a flexible, drop-in solution that seamlessly extends the Auth0 Identity Platform to secure B2B, B2C, and B2E environments without additional authentication hardware, mobile apps, or single-use pin-codes. As Gartner has noted – no one single vendor can deliver for all aspects of identity and access management. Adding a tool like Verified CloudConnect for Auth0 will improve user experience, thereby increasing user adoption and retention. Deployed easily with a simple line of code, Verified enhances your current security stack while reducing operational costs and overall solution complexity.  

Ready to get started with Verified CloudConnect for Auth0? Visit [authID.ai listing](https://marketplace.auth0.com/integrations/verified-biometric-mfa) on the Auth0 Marketplace for more information.

4 Ways to Strengthen Identity Authentication for Technical Roles

bruno-lorenzo

I'm a software engineer with more than seven years of working experience. I worked for four years in a consultant company designing and implementing scalable and flexible systems. 

In 2018 I decided to move on into the iOS world. Currently, I'm working as iOS Tech. Lead at Houlak. I have been involved in several projects of different sizes which gives me the possibility to explore the latest technologies related to the iOS ecosystem.

Software Engineer

Bruno Lorenzo

Take a look at techniques that you can use right now to make your iOS apps more secure.

Security Best Practices in iOS

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

See how easy it is to integrate Java's powerful backend technologies with the latest frontend libraries using Yeoman + JHipster

<div class="alert alert-success alert-icon">
 
 Hey there! We wrote a new and updated version of this blog post that you can find in here: <a href="https://auth0.com/blog/full-stack-java-with-react-spring-boot-and-jhipster/">Full Stack Java with React, Spring Boot, and JHipster</a>.
</div>

Java's library ecosystem is deep and complex. This is both a blessing and a curse: there are great tools out there, but picking the right combination and setting them up to work together can be quite complex. Furthermore, the depth and breath of many of these libraries makes the getting-started step somewhat hard. [JHipster](http://jhipster.github.io/) comes to the rescue. See how easy it is to get started on your new Java + JavaScript web app with it. Read on!

<include src="TweetQuote" quoteText="Java's library ecosystem is deep and complex. This is both a blessing and a curse."/>

-----

## Introduction: Java in the Modern Web
Java's viability as a web platform is tried and tested. Huge projects, such as Netflix, have been in production mode using Java technologies in the backend for extended periods of time. Although popular technologies such as Node.js, Ruby on Rails and Django have been on the rise among startups and a new generation of developers, Java's benefits are undeniable. Although some may find tried and tested technologies boring, Java remains a safe bet for a big number of use cases. So how does Java fit in the ever changing landscape of web development nowadays?

### Modern web apps: REST and Microservices
The rise of [IaaS](https://en.wikipedia.org/wiki/Infrastructure_as_a_service) and [PaaS](https://en.wikipedia.org/wiki/Platform_as_a_service) solutions has pushed [microservices](https://auth0.com/blog/2015/09/04/an-introduction-to-microservices-part-1/) to the forefront. Familiarity with the web has also made [REST](https://en.wikipedia.org/wiki/Representational_state_transfer) the preferred architectural style. Java's extensive support for all sorts of technologies does not fail in this case. A whole bunch of libraries and frameworks are available to pick from. So what are some of the most popular alternatives?

#### Spring
For a long time, [Spring](https://spring.io/) has been one of the most used frameworks in the Java world. With a strong [inversion-of-control (IoC)](https://en.wikipedia.org/wiki/Inversion_of_control) ideology and a somewhat pervasive reliance on annotations in recent releases, Spring has use cases in nearly any backend application. Spring covers many areas of backend development: authentication/authorization, data access, messaging, transaction management, REST services, testing, among others.

#### Netflix Tools
Netflix has contributed a series of open-source tools based on their necessities. [Eureka](https://github.com/Netflix/eureka/wiki/Eureka-at-a-glance), a service registry and failover service that goes hand-in-hand with microservice-based architectures; [Zuul](https://github.com/Netflix/zuul/wiki), a proxy with dynamic routing; and [Ribbon](https://github.com/Netflix/ribbon/wiki), a load-balancer.

#### Hibernate
[Hibernate](http://hibernate.org/), an implementation of the Java Persistence API, is a popular alternative for object-relational mapping (ORM). Although you may prefer to skip ORM, Java has great support for it.

#### SQL and NoSQL
Popular choices in the SQL camp include [MySQL/MariaDB](https://en.wikipedia.org/wiki/MariaDB) and [PostgreSQL](http://www.postgresql.org/). In the NoSQL camp: [MongoDB](https://www.mongodb.org/) and [Cassandra](http://cassandra.apache.org/) are good alternatives.

Setting up a combination of these libraries, frameworks and tools can be quite bothersome. Let's see how we can do that with JHipster.

## Setup a New Project with JHipster
First, we have to make sure we have all the baseline dependencies: [Java 8](https://java.com/en/download/) and [Node.js](https://nodejs.org/en/).

#### 1. Install JHipster

```sh
npm install yo generator-jhipster
```

It is also a good idea to make sure Gulp and Bower are available:

```sh
npm install gulp bower
```

> You can perform global installations using `npm install -g <package>`.

#### 2. Create a Project

```sh
yo jhipster
```

![JHipster screenshot](https://images.ctfassets.net/23aumh6u8s0i/3GJoD0dvqAPO7uPSV60VAC/1cccdf552ba212a328291e78c4d2851d/jhipster)

You will be asked a series of questions about your project. Most of these are [self explanatory](http://jhipster.github.io/creating-an-app/). There is one question that may not be entirely obvious: monolithic vs microservice application. JHipster makes a hard distinction between applications that bundle frontend and backend components in a single distributable/runnable artifact and applications that don't. As you can imagine, monolithic applications are those that bundle frontend and backend components together. The [microservices profile](http://jhipster.github.io/microservices-architecture/) allows you to build independent components that run in separate instances, usually providing RESTful services. In this case, Netflix Eureka is used to register services and make sure they are running. If these are your first steps developing Java + JavaScript apps, go for the monolithic approach. You will find it simpler, for now.

After all questions are answered, run the boot step. This will make sure all dependencies are installed and you are ready to start working on your app:

```sh
# In case you picked Maven:
mvn spring-boot:run

# In case you picked Gradle:
gradle bootRun
```

#### 3. Fire up Your IDE!
I love [IntelliJ IDEA](https://www.jetbrains.com/idea/). Most Java IDEs can import Maven and Gradle project setups. Open your IDE and point it to your new JHipster project directory.

![Import JHipster project](https://images.ctfassets.net/23aumh6u8s0i/2rprBw9UpYSHWdJGwueJt2/ed9c265b3b1196171b6f5b68348ae567/import)

Additional IDE specific settings may improve your experience. For instance, you may want to setup autocompletion for the frontend libraries if supported. JHipster docs provide details for [Eclipse and IntelliJ IDEA](http://jhipster.github.io/configuring-ide/).

#### 4. Next Steps
The sky is the limit. In general, you will want to create new views, models and controllers and create some sort of mapping between them and other components in your application. JHipster's help does not stop at the project creation stage: it can help you add new components to your existing app. For this, we can create *entities* using `yo jhipster:entity <entityName>`. New entities create database documents or tables, the necessary ORM code, an AngularJS controller (and router and service), a HTML view and tests. In other words, JHipster does all the boilerplate for you.

But there's more. Complex applications usually have many entities and relationships. Keeping track of these can be problematic. Furthermore, designing a coherent architecture can be troublesome without proper visualization tools. Again, JHipster comes to the rescue: [JHipster-UML](http://jhipster.github.io/jhipster-uml/) and [JDL-Studio](http://jhipster.github.io/jdl-studio/). JHipster-UML takes the output from common UML editors (such as Modelio) and generate entities from them. JDL-Studio, on the other hand, is a web-based UML-like visual editor that can create `JDL` files. These files can then be fed to JHipster's entity generator. How cool is that?!

![JHipster's JDL studio](https://images.ctfassets.net/23aumh6u8s0i/4qIrzSGvdooiOSctkqc8dQ/2612d9e791f40faef5ae94ee51fbb9e3/jdl-studio)

Application logic may be more complex than what can be reasonably put inside entities. In this case, separate units of work may be required. These are called [services](http://jhipster.github.io/creating-a-service/) by JHipster. A call to `yo jhipster:service <serviceName>` will create a service stub for you to modify.

You will also want to focus on cross-cutting concerns such as authentication/authorization, logging and monitoring. Fortunately, Spring excels at this thanks to its aspect-oriented design. The base JHipster project has a good example of this in the `LoggingAspect` class.

## Aside: Did you know you can use Auth0 with Java?
JHipster comes with three choices for authentication: standard session based authentication, OAuth2 authentication and JWT authentication. If you know what we do at Auth0, you know we use JWTs everywhere. Therefore, it should come as no surprise to know you can add Auth0 to a JHipster app.

But before getting started a word of caution: JHipster generators write a lot of code for you. In fact, the basic application generated by JHipster sets up a database for authentication when picking JWT as the choice. Therefore, some work is needed to set up Auth0 as the backend. We will use the monolithic base application, using JWT as an auth mechanism. So, let's get started!

<include src="TweetQuote" quoteText="JHipster generators write a lot of code for you."/>

#### 1. Set up Auth0 Lock and its frontend dependencies
As JHipster apps are Angular apps, adding the dependencies is as easy as:

```sh
bower install auth0-lock auth0-angular a0-angular-storage --save
gulp # to automatically update the index.html file.
```

#### 2. Set up Auth0's Java library
If you picked Gradle, open `build.gradle` and add the following dependency:

```Groovy
dependencies {
 compile 'com.auth0:auth0:0.1.1'
 // (...)
}
```

Or, if you picked Maven:

```XML
<dependency>
 <groupId>com.auth0</groupId>
 <artifactId>auth0</artifactId>
 <version>0.1.1</version>
</dependency>
```

#### 3. Set up Auth0 Lock
Create a new app in the [Auth0 dashboard](https://manage.auth0.com) and get the application domain and client id. Then set these in `src/main/webapp/app/app.module.js`:

```JavaScript
angular
 .module('testApp', [
 'ngStorage',
 'tmh.dynamicLocale',
 'pascalprecht.translate',
 'ngResource',
 'ngCookies',
 'ngAria',
 'ngCacheBuster',
 'ngFileUpload',
 'ui.bootstrap',
 'ui.bootstrap.datetimepicker',
 'ui.router',
 'infinite-scroll',
 // jhipster-needle-angularjs-add-module JHipster will add new module here
 'angular-loading-bar',
 'angular-storage', // <---- ADD THIS
 'auth0' // <---- ADD THIS
 ])
 .config(config)
 .run(run);

// New config function, add it.
function config(authProvider) {
 authProvider.init({
 domain: 'YOUR_AUTH0_DOMAIN',
 clientID: 'YOUR_CLIENT_ID'
 });

 authProvider.on('loginSuccess', function($location, profilePromise, idToken, store, $localStorage) {
 profilePromise.then(function(profile) {
 $localStorage.authenticationToken = idToken;
 });
 });

 authProvider.on('loginFailure', function($location, error) {
 console.log('Login error');
 });

 authProvider.on('authenticated', function($location) {
 console.log('Still authenticated');
 });
}
```

#### 4. Set the right client secret in Application.yml
Open `Application.yml`, find `jhipster.security.authentication.jwt.secret` and set it to the client secret found in your Auth0 dashboard.

```yml
jhipster:
 security:
 authentication:
 jwt:
 secret: YOUR_CLIENT_SECRET
```

#### 5. Show Auth0 Lock when requested
Now, when the user wants to login, rather than show JHipster's custom login form, we will show Auth0 Lock. To do this, edit `login.service.js`. You can find this file at `src/main/webapp/app/components/login/login.service.js`:

```JavaScript
function LoginService ($uibModal, auth, $localStorage, $rootScope) {
 var service = {
 open: open
 };

 var modalInstance = null;
 var resetModal = function () {
 modalInstance = null;
 };

 return service;

 function open () {
 auth.signin({
 authParams: {
 scope: 'openid app_metadata'
 }
 });
 }
}
```

Normally at this point you would set up an Angular HTTP interceptor to add the JWT to each HTTP request. Fortunately this was already done by JHipster. You can see this at `src/main/webapp/app/blocks/interceptor/auth.interceptor.js`.

#### 6. Add roles to your users!
A piece of cake. Go to to the Auth0 dashboard, then go to [rules](https://manage.auth0.com/#/rules). Add a new rule:

```JavaScript
function (user, context, callback) {
 user.app_metadata = user.app_metadata || {};
 // You can add a Role based on what you want
 // In this case I check domain
 var addRolesToUser = function(user, cb) {
 var endsWith = '@admindomain.com';
 if (user.email && (user.email.substring(user.email.length - endsWith.length, user.email.length) === endsWith)) {
 if (!user.email_verified) {
 return callback(new UnauthorizedError('Please verify your email before logging in.'));
 } else {
 return callback(null, user, context);
 }
 cb(null, ['admin']);
 } else {
 cb(null, ['user']);
 }
 };

 addRolesToUser(user, function(err, roles) {
 if (err) {
 callback(err);
 } else {
 user.app_metadata.roles = roles;
 auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
 .then(function(){
 context.idToken['https://admindomain.com/roles'] = user.app_metadata.roles;
 callback(null, user, context);
 })
 .catch(function(err){
 callback(err);
 });
 }
 });
}
```

This rule will make all users with `admindomain.com` emails administrators by adding the `admin` role to their JWT.

> **Note:** Since you are giving the `admin` role to some users, it will be a good idea to require that these users have to [verify their emails before proceeding](https://auth0.com/rules/email-verified).

#### 7. Change the backend to pick the roles from the right key
Go to `TokenProvider.java` and change `getAuthentication` in the following manner:

```Java
public Authentication getAuthentication(String token) {
 Claims claims = Jwts.parser()
 .setSigningKey(secretKey)
 .parseClaimsJws(token)
 .getBody();

 String principal = claims.getSubject();

 // CHANGES START HERE
 String roles = claims.get(AUTHORITIES_KEY, Map.class).get("roles").toString();
 if(roles != null && roles.length() > 0) {
 roles = roles.substring(1, roles.length() - 1);
 }

 Collection<? extends GrantedAuthority> authorities =
 Arrays.asList(roles.split(",")).stream()
 .map(authority -> new SimpleGrantedAuthority("ROLE_" + authority.toUpperCase()))
 .collect(Collectors.toList()); 

 return new UsernamePasswordAuthenticationToken(principal, token, authorities);
}
```

As you can see, roles are present in a different key in JHipster example. With the above code, our new roles key works as expected.

Also note that the token is now passed to `UsernamePasswordAuthenticationToken`. This makes it easy to retrieve the id token in the future.

#### 8. Go nuts!
Now its time to wreak havoc. It is up to you to choose what you prefer at this point. JHipster's `UserRepository`, `UserService`, `UserDetailsService`, `AccountResource`, `UserResource` and `UserJWTController` handle logins by fetching user information from a database. You may choose to follow this path by mapping or creating new users in this database with the information provided by Auth0. Or you may choose to remove all this code and settle with a simple proxy to Auth0's user profile service. Whatever you choose, these classes and their respective frontend counterparts will need to be modified. Bear in mind Auth0's Java API does not provide a user list service. In other words, user management as shown by JHipster's sample application cannot be implemented without a database in your backend.

Retrieving the user profile is as easy as:

```Java
@Service //Or some other Spring-enabled entity
public class SomeClass {
 private static final Auth0 auth0 = new Auth0("YOUR_AUTH0_DOMAIN", "YOUR_CLIENT_ID");

 public Request<UserProfile> getUserProfile() {
 SecurityContext securityContext = SecurityContextHolder.getContext();
 Authentication authentication = securityContext.getAuthentication();
 String token = (String)authentication.getCredentials();
 AuthenticationAPIClient client = auth0.newAuthenticationAPIClient();
 return client.tokenInfo(token);
 }
}
```

Using the returned `Request` object is simple enough:

```Java
request.start(new BaseCallback<UserProfile>() {
 @Override
 public void onSuccess(UserProfile u) {
 //u.getId()
 //u.getEmail()
 //u.getName() 
 }
 @Override
 public void onFailure(Auth0Exception error) {
 }
});
```

For simpler use cases there is also `spring-security-auth0`, a library to easily secure request paths using Auth0 and Spring. See the [docs](https://auth0.com/docs/server-apis/java-spring-security) to find if this fits your use case the best. Or <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up</a> and try it yourself!

## Conclusion
Java frameworks are complex beasts. Dependency injection, broad applications, and great flexibility come at a cost: getting started can be quite a burden. Fortunately JHipster can take a lot of that pain away, as long as the choice of preselected tools is what you had in mind. If Angular.js + Spring is your cup of tea, forget about the boilerplate and get started in a few minutes. Try it, you might be pleasantly surprised.

<div class="mv-widget" data-widget="poll" data-id="HJuZF52qot0XaO0wpIP1YT6z1mv" data-width="100%" data-height="auto"></div>
<script src="//d6launbk5pe1s.cloudfront.net/widget.js" async></script>

Easily Generate a Full-Stack Java + JavaScript App with JHipster

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Auth0 recognized among Britain’s five best places to work in technology, and one of 20 “most engaged” employers

**LONDON – 2 November 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within [Okta, Inc.](https://www.okta.com/) (NASDAQ: OKTA), today announced it has been named among Britain’s five best places to work in technology, and one of the top 20 “most engaged” employers in the [WorkL Workplace Awards 2021](https://www.telegraph.co.uk/business/2021/10/26/winners-workl-workplace-awards-2021-revealed/).

Conducted in partnership with The Telegraph, the awards recognize UK employers across 26 industries that score highest on a staff satisfaction survey. The five companies with the highest scores in each category are awarded gold status for the most engaged workforce. Of the 20,000 companies that entered, a select few are also recognized as the most inclusive, best in well-being, and having the most engaged employees – including Auth0.

“I’m pleased to congratulate Auth0 on its gold medal. After such a difficult 18 months in business, I’m pleased that our awards are celebrating organizations that are leading the way, creating happy and engaged employees,” said Lord Mark Price, founder of WorkL, and former UK Trade Minister and ex-managing director of British supermarket brand, Waitrose & Partners.

Employer scores, called the “Workplace Happiness Score,” are calculated based on employee feedback about reward and recognition, information sharing, empowerment, well-being, and other elements of job satisfaction over the past year. The awards are the latest in a series of accolades recognizing Auth0’s remote working DNA and culture, including the [UK’s Best Companies to Work For List](https://auth0.com/blog/auth0-named-one-of-the-10-best-mid-sized-companies-to-work-for-in-london/) and [Best Companies Accreditation](https://auth0.com/blog/auth0-awarded-highest-accreditation-by-best-companies-uk/).

“We owe a tremendous debt of gratitude to our employees who responded to the survey, and all who continue to make Auth0 a great place to work,” said Steven Rees-Pullman, SVP International at Auth0. “From Auth0's inception, our founders instilled values of transparency, collaboration, and experimentation into the business. Those values are exemplified by all of our employees and create this award-winning culture. Many congratulations to all!”

Auth0 is now part of Okta, the leading independent identity provider, with a vision to provide secure access to any technology. Learn more about what it’s like to work here, and apply to join our growing team on the [Auth0 Careers Page](https://auth0.com/careers).

<include src="asides/AboutAuth0" />

### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com)

Auth0 Wins Gold at WorkL Workplace Awards 2021

Desire for ease and security driving consumers to seek out modern identity technology

> Editor's Note: The Login Experience Customers Want study has been expanded to include 12 markets and is now available as part of The Log Inn campaign. To learn more about the campaign and read the full study please visit: https://info.auth0.com/expectation-vs-reality

**LONDON – June 1, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced findings from its international research into Customer Identity and Access Management (CIAM), ‘[The Login Experience Customers Want](https://info.auth0.com/expectation-vs-reality).’ The study, conducted by Auth0 and YouGov, reveals that most organizations fail to meet consumer expectations around login technology, highlighting how a login box can impact the user experience of a brand.

The study found that consumers around the world want greater choice in login technologies, and actively seek them out. Half (47%) of consumers surveyed say they are more likely to sign up to an app or online service if a company offers Multi-factor Authentication (MFA). More than four in ten (44%) are also more likely to sign up if they can log in with [Single Sign-On (SSO)](https://auth0.com/case-studies/siteminder/) – using a single ID and password for multiple related services, followed closely by demand for biometrics (42%), [social logins](https://auth0.com/case-studies/flo-health/) (34%), and passwordless (32%). 

Most businesses don’t offer these login options, despite the demand, and general [frustration with using traditional passwords](https://info.auth0.com/expectation-vs-reality). While 45% of businesses surveyed do offer SSO capabilities, less than [one-third offer MFA](https://auth0.com/case-studies/siemens/) (28%), biometrics (21%), social logins (31%), or passwordless (20%). Across the six markets surveyed, 11% of the IT and marketing decision makers said they don’t offer any of these login technologies.

“Clearly, there’s a gap between consumer and business expectations, but it really comes down to convenience. Consumers want to use digital services, but if the login process is clunky or frustrating, they will take their businesses elsewhere,” said Steven Rees-Pullman, SVP, International at Auth0. “With the proliferation of online threats, organizations are challenged to find the right balance between ease and security, and it’s really an ‘aha moment’ when they realize how identity management can help.”

Comparing the results internationally, European organizations are on par with their Asia-Pacific counterparts in offering SSO for their customers; however, they’re well behind the curve when it comes to biometric login adoption vs. consumer expectations. UK businesses are falling especially short when it comes to biometrics, where only 14% of businesses offer biometrics, MFA (28%), and passwordless (13%). 

APAC organizations are ahead of their European counterparts in offering technology such as social logins, biometrics, and MFA. Australian and Singaporean businesses are twice as likely to use biometric login, with 34% of IT and marketing decision-makers surveyed saying their companies currently offer customers the ability to log in with the use of biometrics, compared to Germany (17%), Japan (15%), France (14%), and the UK (14%).

“MFA and SSO are still relatively new technologies for the vast majority of organizations, and developing biometrics or passwordless is a heavy lift,” adds Rees-Pullman. “With a modern identity platform, businesses can not only offer the easiest and most secure user experience possible, but they can also experiment with different login options to find what works best for their audience.”

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), provides a modern identity platform that helps organizations meet the security, privacy, and convenience needs of their users. Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) to learn more.

## Methodology

‘The Login Experience Customers Want’ study was conducted online by Auth0 and YouGov between 23 February and 1 March 2021. The research consisted of two surveys, questioning more than 8,000 consumers and 1,200 IT and marketing decision-makers who work for businesses that offer an app/online service to customers (excluding sole-traders) across six global markets: the UK, France, Germany, Australia, Singapore, and Japan. The data for the consumer study was post-weighted by age, gender, and region to reflect the latest population estimates in each market.

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com)

Businesses Fall Short of Consumer Expectations for Login Experiences, Auth0 Survey Reveals

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Here’s an easy-to-understand analogy to help your non-technical friends and customers understand public keys and private keys, and how they relate to cryptography and digital signatures.

**If you work in cybersecurity or any computer-related field, sooner or later, you’ll have to explain public-key cryptography and digital signatures to non-technical people.** With the recent rise of remote work and stories about system breaches, computer security has become a topic of discussion even among laypeople.

After trying to explain public-key cryptography and digital signatures to some clients with varying degrees of success, I wanted to develop an analogy that explained them and was easy to remember. I’ve found that even techies get confused by the formal definitions, and many non-technical explanations just seem unsatisfying.

That’s when I stumbled upon [Panayotis Vryonis’](https://twitter.com/vrypan) article, [*Public-key cryptography for non-geeks*](https://blog.vrypan.net/2013/08/28/public-key-cryptography-for-non-geeks/). It became my go-to analogy until my computer science professor, [Dr. Robin Dawes](http://research.cs.queensu.ca/home/dawes/) pointed out a flaw. I refined it with his help, and a suggestion from Matthew Ernest, and the result is below. I hope you find it helpful when trying to explain these concepts to anyone!


## The Box

Imagine a box with a special lock, as pictured below:

![Photo of a box with a lock. There is a key inserted into the lock. Caption: "The box has a lock with three positions: Locked (at the 9:00 position), unlocked (at the 12:00 position), and locked (at the 3:00 position)."](https://images.ctfassets.net/23aumh6u8s0i/4nm7EvXpqVqMxfOPkjUlXe/bca6b7d8d0a00658045dd4f3fd0a5c7f/the_box_has_a_lock_with_three_positions.png)

The lock has three positions:

1. When the lock is at the “9:00” position, the box is locked, and its contents are inaccessible.
2. When the lock is at the “12:00” position, the box is unlocked, which means you can open it and view its contents.
3. When the lock is at the “3:00” position, the box is locked, and its contents are inaccessible.

In order to avoid wandering into endless “What if...?” tangents, assume that it’s prohibitively costly to pick the lock or break the box.


## The Keys

There are two kinds of keys that work with the box’s lock.

### The private key

The first kind of key belongs to you, and only you. You don’t share it with anyone else, which is why it’s called the **private key**. You might make a backup copy in case of emergencies, but you keep it in a safe place that only you know.

![Photo of a single key. Caption: "You keep the private key to yourself."](https://images.ctfassets.net/23aumh6u8s0i/2PJXCaqzggdgTpN4FSm8Qj/4a1228e2e8a6a46ad103c01ffd197e58/you_keep_the_private_key_to_yourself.png)

The private key fits the lock, but it has a particular limitation: it can only turn *clockwise*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "The private key only turns clockwise."](https://images.ctfassets.net/23aumh6u8s0i/qqPVi6JTc2HOW4SuE4sEj/8fcd841021e55b659a3c5b92ad9b2da2/the_private_key_only_turns_clockwise.png)

### The public key

You treat the second kind of key very differently. Unlike the first key, you’ve made many, many copies of these keys. You’ve given them to everyone you know, and even people you don’t know. You’ve left them in as many public places as you could reach: restaurants, stores, busy streets, dark alleys, and any place you happened to pass through. You’ve even left them in other towns, and even other countries! Because of the way you treat this key, it’s called the **public key**.

![Photo of hundreds of keys hanging on hooks on a wall. Caption: "You hand out copies of the public key freely."](https://images.ctfassets.net/23aumh6u8s0i/2LTNf9JxfjDuB4rMZyM7K6/4a3a6264b81bf2b90efaffe469d3406c/you_hand_out_copies_of_the_public_key_freely.png)

Like the private key, public keys also fit the lock, and they also have a particular limitation — but in the opposite direction. They can only turn *counterclockwise*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "The public key only turns counterclockwise."](https://images.ctfassets.net/23aumh6u8s0i/6QVsGSSoLuNdRgpfHznh6H/b5f42c68a9d5aa9e322e898cac14aeb3/the_public_key_only_turns_counterclockwise.png)


## How They Work Together

The lock, private key, and public keys work together to produce these interesting outcomes:

* If the box is locked with a public key, only the private key can unlock it.
* If the box is locked with the private key, only a public key can unlock it.

The keys are designed so that you can’t use one key to figure out how to make the other key.

We can use the box and keys to create two useful kinds of secure communication:

1. I can send you a secret message.
2. You can send me a message with proof that you (and not some impostor) sent it and that it wasn’t altered *en route*.

Let’s take a closer look at each of these kinds of secure communication.

## Sending Secret Messages

Suppose I wanted to send you a message that I wanted only you to read. We have enemies in common who’d love nothing more than to know what’s in the messages I send you.

We each have a cadre of minions to deliver our messages. We trust them... to a limited extent. It would be all too easy for our foes to intercept our messages through force or bribery. 

There must be a way to send messages to you secretly, and that’s where the box comes in. I can use the box to send the message so that no one but you can read it. 

You have the only private key. Everyone else has at least one of the public keys because you’ve been giving them away like candy. 

I put my message in the open box. Since it’s open, it’s unlocked, which means the lock is at the “12:00” position. 

I use one of the many copies of the public key that I own to lock it, turning it counterclockwise from the unlocked “12:00” position to the locked “9:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "I lock the message in the box with the public key..."](https://images.ctfassets.net/23aumh6u8s0i/3WnNKlXN7MC0BfDdEU8GyX/2bcc1521f829c80ff548cf7234078bba/i_lock_the_message_with_public_key.png)

The message is now ready for a minion to deliver to you.

I’m not worried that my minion or anyone other than you will be able to read the message while it’s in transit. Even though anyone can easily find the public key, they can’t use it to unlock the box. Only the private key can unlock the box if it’s been locked with the public key.

When you receive the box, you use the private key to unlock it, turning the key clockwise from the “3:00” position to the “12:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "...and you unlock it with the private key."](https://images.ctfassets.net/23aumh6u8s0i/2kwG5ogtYDYCkDtjC0MqgN/75f2cb365ea0014a0af58a7dbc90c481/you_unlock_it_with_the_private_key.png)

In summary: to send you a secret message, I use a public key to lock the message so nobody can read it, and you use a private key to unlock the message so that you can read it.

This is the general idea behind public-key encryption: **encrypt with the public key, decrypt with the private key.**

## Signing Messages

The “secret messages” use case for the box and private and public keys is intuitive: anyone with a public key can lock a message, but only the holder of the private key can unlock it.

There’s another way to use the box and keys: you can lock a message with the private key, which anyone with the public key can unlock. What could a possible use case there be for a system where anyone can unlock the box?

Suppose one of our common enemies has been trying to break up our alliance and that I’ve been receiving very hurtful messages that appear to have come from you. (I’ll leave the content of those messages to your imagination.)

That enemy has either been sending fake messages or has been intercepting and altering your real ones. There has to be a way to package a message in order to prove that it’s actually from you!

There *is* a way: the box!

In this scenario, you put your message in the open box. Since it’s open, it’s unlocked, which means the lock is at the “12:00” position. 

Using the private key, you “sign” the message by locking it, turning the key counterclockwise from the “12:00” position to the “9:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "You 'sign' the message with the private key..."](https://images.ctfassets.net/23aumh6u8s0i/1U2aOr7mKgMtGdZM8lPLWT/82ff89d7160d93b04fff8ac635fd41d7/you_sign_the_message_with_the_private_key.png)

One of your minions delivers the box to me.

Since you locked the box with the private key, anyone can unlock it with any one of the many public keys you have distributed. Our common enemy, knowing that this message is in transit, could intercept it and replace your invitation to tea with a “top ten” list of very cutting insults that would surely dissolve our alliance.

The problem with the enemy’s plan is that it won’t work. Intercepting and altering the message means that they would have to do one of two things before forwarding the box to me.

1. They could leave the box unlocked. Since the box is supposed to arrive locked, this is an obvious sign that the message may have been tampered with.
2. They could lock the box. They would have to do it with a public key, which means that only the private key can unlock it. I wouldn’t be able to unlock the box with the only key I had — the public key — which would lead me to conclude that someone had unlocked the box before I did.

If the box arrives at my doorstep and...

* It’s locked
* I can unlock it with the public key

...then, I can be assured that the message came from you and wasn’t changed *en route*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "...and I verify your 'signature' with the public key."](https://images.ctfassets.net/23aumh6u8s0i/4Fax8BanX5Qts7KJzW7166/b4dc34b169f6eca961c8d8f3c7452af4/i_verify_your_signature_with_the_public_key.png)

In summary: to send me a message with proof that you are the sender, you use the private key to lock the message. You’re the only person with the private key, and only a public key can unlock messages locked with the private key. If one of the public keys can unlock that message, I know that it came from you.

This is the general idea behind digital signatures: **sign with the private key, verify with a public key.**

## How About Sending a Message That’s Both Secret *and* Signed?

You might think that sending a message that is both secret and signed is paranoid. I would answer by saying, “Paranoia is the ***mistaken*** impression that people are out to get you.”

Suppose I wanted to send you a secret signed message. I could do it with two boxes:

1. A smaller box, which I own. It will prove that I sent the message. I have the private key for this box, and you have one of its public keys.
2. A larger box, which you own. It will keep the message secret. You have the private key for this box, and I have one of its public keys.

I would lock the message in my smaller box using my private key and then lock it in your larger box using your public key.

When you receive the delivery, you will unlock your larger box first, using your private key. This would reveal my smaller box inside, which you would unlock with my public key.


## It’s Not Keys and Boxes, but Numbers and Algorithms

Of course, we’re not really dealing with boxes, keys (at least the kind that goes into locks), or minions. Here’s a list of elements in these stories and their real-world equivalents:

* **The message**: Anything that you’d want to send that can you can view or edit with a computer. It could be text, one or more pictures, an audio or video recording, a database, or even an application. As far as the computer is concerned, messages are just a long series of numbers.
* **The private and public keys**: Very large numbers that are used in a lengthy math process to encrypt, decrypt, sign, and verify messages.
* **The box**: An algorithm that takes the message and keys and performs the math process to encrypt, decrypt, sign, and verify messages.
* **Minions**: The way in which the message is sent. This could be the internet but could just as easily be an actual minion, such as an unsuspecting summer intern with a USB key.

In the alternate universe where messages are sent with boxes and keys, everyone would have their own set of boxes with their own private keys, as well as copies of other people’s public keys. In the real world, we run applications that run public-key encryption and digital signature algorithms to secure our messages. We still use public and private keys in the real world; they’re just digital.

How to Explain Public-Key Cryptography and Digital Signatures to Anyone

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

The tech market in Latin America is growing; Auth0 can help you keep up with a scalable identity solution.

The number of Venture Capital deals signed in Latin America hit a record high of 488 in 2020. That’s nearly double the 2017 number according to [Bloomberg](https://www.bloomberg.com/news/articles/2021-03-16/latin-american-startups-had-record-venture-capital-deals-in-2020). The growth in the tech market in LatAm isn’t only apparent in new startup deals; companies who already have a presence in the region are expanding both through mergers and acquisitions and by looking into new countries to grow their footprint in the region. 

Each scenario brings its own challenges for your IT infrastructure, particularly your[ identity solution](https://auth0.com/blog/how-to-scale-quickly-with-identity/). If you’re expanding into a new country, there’s likely to be a different data privacy regulation you’ll have to comply with. And that startup you’re eyeing probably has a vastly different infrastructure than yours, whether private or public cloud or even legacy on-prem. An Identity management solution has to be able to expand and flex in order to grow with your company, regardless of the specific scenario.

![Business Expansion](https://images.ctfassets.net/23aumh6u8s0i/1HnNeEEQ4hCBb2M4y2ZerT/5b5a1de004ea8021fdc38d042a85a672/Latam05.jpg)

## With Business Expansion Come Business Questions

Let’s take a look at those two potential growth scenarios and what they mean for your business’s identity solution. First up is the acquisition of a competitor or related smaller entity. [Mergers and acquisitions](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/) (M&A) always bring an array of unique challenges, but for this article, we’re going to focus on the identity challenges associated with the merging of IT infrastructure.

Your web app may be hosted on a public cloud, but the company you just bought has been in business for a while and is still using on-prem hosting for theirs. In order for you to bring both properties together under one identity solution, you need one that can bridge the gap between the two, allowing your new audience access to both apps without managing multiple sets of credentials.

In our second scenario, your organization is considering an expansion into a neighboring country to take advantage of the easing of business restrictions and the growing market for your product that your marketing team has identified. You already comply with the privacy regulations in your country, but are you ready to comply with those abroad? 

Is your organization ready to answer questions like these:

* Can our existing in-house identity platform scale to include our hybrid-cloud infrastructure and the legacy system our latest acquisition uses?
* Is our identity solution ready to handle the influx of new user accounts and login requests when we roll out to our new market?
* Is our consent gathering process in compliance with the regulations in the country we’re expanding into?

If not, or if the answer to any of these questions is “no,” it may be time to consult with an identity specialist. 

<include src="TweetQuote" quoteText="Auth0 recommends you always consult legal counsel when it comes to complying with data privacy regulations." />

## Auth0 Is the Identity Solution That Scales With You

Both of these scenarios mean you’re going to be scaling your infrastructure, adding users to existing web apps, and even adding new web apps. Having an identity solution in place that can easily expand to include controlling access to these new properties can help reign in costs and speed your time to market post-expansion. Our customers tell us that by using Auth0 for their authentication and identity needs, they took their time-to-value from months or years down to weeks or even days.

Credit card company [Visa reported](https://www.marketwatch.com/story/visa-sees-massive-digital-acceleration-with-millions-trying-e-commerce-for-the-first-time-2020-05-13) that during just the first month of the COVID-19 pandemic, more than 13 million cardholders in Latin America made their very first e-commerce transaction. That’s 13 million new accounts being created, 13 million new logins, and 13 million opportunities for identity to go wrong if your solution isn’t scalable. There are many aspects to what makes something scalable. When it comes to identity, we see five as being the most important.

1. **Bridging legacy and cloud systems**

One of the downsides to M&A is that your IT department inherits the backend infrastructure of the other company, for better or worse. Auth0’s extensive SDK libraries and robust APIs mean it’s a simple matter to bridge the gap between legacy systems and modern cloud-first ones. One login box can take your current and new customers to both web apps, no matter where they’re hosted. This ability also speeds your time to value because your developers can maintain focus on their core product delivery rather than piecing together connectivity solutions that may only work for a short time.

2. **Single source of truth for customer data**

Bringing all of your customer data together into one single source of truth (SSoT) makes it that much easier to protect. It also speeds access when a user logs in, as no matter which property they’re using, it has only one place to look to find their credentials, rather than scouring multiple data silos.

3. **Single sign-on**

Customers want low-friction experiences online, and being able to create an account using credentials they already have is a great way to win them over. Single sign-on (using account information from a provider like Apple, Facebook, or Twitter) allows a customer to create an account on your site quickly and easily, and without the need to create and remember a new password.

4. **Breach protection**

The issue of passwords brings us to a major sticking point for many identity solutions, protecting user information from data breaches. According to the most recent [IBM/Ponemon Cost of a Data Breach Study](https://www.ibm.com/security/data-breach), the global average cost of a breach is now $3.86 million (USD). And Verizon reports in their [2021 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) that 61% of breaches involve misuse of credentials. Put those together, and you see why protecting your customers’ information is such a major piece of scaling your online business presence and why a robust identity solution needs to take this aspect into account.

5. **Protection from staffing fluctuations**

An often overlooked aspect of identity projects is the simple fact that people change jobs. If you have an identity tool that was developed in-house two years ago, there’s a good chance you won’t have anyone on staff who can expand it to cover your new properties. That will delay roll-out and extend your time-to-market. 

[Auth0 customer WABI](https://auth0.com/case-studies/wabipay/) is modernizing e-commerce in Latin America. They’re currently active in 11 countries and have expansion plans to add four more in 2021. And they’re trusting Auth0 to scale their identity solution to match these ambitious plans. “WABI is scalable, and we need a partner that is, too. We believe Auth0 will support us in getting there.” Says WABI Business Manager Juan Manuel Mingo. With their planned expansion opening their market to millions of potential new customers, WABI knows they need a robust identity platform that’s ready to handle the influx of new users.

## Auth0 Brings Global Experience to Your Latin America Growth Plans

Our founders are from Argentina, the company was started in the United States, and we currently have people in 30+ countries with more being added every day. Our [international team](https://auth0.com/blog/auth0-expands-global-partner-network-in-latin-america-with-clm/) of identity specialists can help you work out your identity needs and help get you set up with an identity as a service (IDaaS) platform that is ready to grow with your company, no matter what your expansion plans look like. We know that having an identity solution designed to be extensible and flexible to move with your business can mean the difference between a successful rollout or a failed acquisition attempt. 

Auth0 is built on open standards, making it easy to connect with existing systems and varying infrastructure scenarios. Bridging the gap between a public cloud-based web app and an on-prem user database is only the beginning. Our extensive marketplace of integrations means you can connect with your existing business software solutions as well.

Our breach protection includes features such as [bot detection](https://auth0.com/docs/attack-protection/bot-detection), [adaptive MFA](https://auth0.com/multifactor-authentication), [single sign-on](https://auth0.com/single-sign-on), and [passwordless](https://auth0.com/passwordless) flows. And the [Auth0 Marketplace](https://marketplace.auth0.com/) has what you need to handle everything from consent management to business process software integrations. The protections and extensibility we offer is a key factor in our scalability. 

When the time comes to expand across borders, Auth0 is ready. We’re certified by a third party as compliant with the International Standards Organization (ISO) standards [ISO27001](https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en) and [ISO27018](https://www.iso.org/standard/61498.html) for handling information security and personally identifiable information (PII) as a cloud provider.

![Growing](https://images.ctfassets.net/23aumh6u8s0i/1sBMtrIri0sAw0OBkWE4QV/41d7fc8b0740ac05ec3c82145fd1478f/Latam06.jpg)

## Auth0 is the Identity Solution That Can Keep Up With The Growing LatAm Market

To provide your customers with a continuous, low-friction, and intuitive login flow requires a robust identity solution. Whether you’re scaling internationally or your growth plans call for staying closer to home, Auth0 can provide the IDaaS platform you need to maintain a great customer experience while ensuring the security and privacy of your customer data. And don’t worry if you’ve already started an identity project and hit a stumbling block, [our experts can help](https://auth0.com/contact-us). 

<include src="asides/AboutAuth0" />

Can Your Identity Solution Grow With Your Company?

richard-marr

GM, APAC

Richard Marr

Bolstered by a 42% increase in unicorns, India’s technology startup scene is powered by developers focusing on new core products

Have you noticed the number of Indian startups making international news lately? Well, the world media and investors sure have, and with good reason. The startup scene in India has not only weathered the last year of global uncertainty, it’s managing to thrive by staying focused on core offerings. According to a report from [KPMG and Pitchbook](https://home.kpmg/xx/en/home/campaigns/2020/01/q4-venture-pulse-report-asia.html), that worked out to 2019 Q3 returns in the $3.6 billion range. 

Fortune India reports that as of the end of 2019, India was home to [26 unicorns](https://www.fortuneindia.com/bengaluru-buzz/indias-unicorn-club-set-to-expand-in-2019/102896). And according to Inc42, by the end of 2020, [11 more were added to the ranks](https://inc42.com/infocus/year-end-review-2020/11-indian-startups-that-defied-the-pandemic-to-enter-the-unicorn-club/). That’s an increase of 42%, during a global pandemic no less. The keys to this success are varied, some say it’s the wide range of user pain points these products address — from remote learning platforms to touchless payment options, and from low-interest loans for struggling students to drones that are helping wipe out malaria.

Today, we want to give you an overview of the technology startup scene in India, starting with a brief history showing the roots of today’s expanding successes. Then we’ll touch on a couple of our favorites to highlight the diversity of needs being addressed. And finally a look at the developer-focused nature of some of the startups we’re working with, and how this model is helping them thrive in today’s reality.

<include src="QuoteCard" body="We wanted a single sign-on solution for our employees that gave them seamless and secure access to various company applications. Auth0 fit that bill and it was nice that we did not have to manage the service ourselves. It also allowed us to set rules to limit user access to specific applications. We also like the fact that we can integrate and test multiple tenants/applications in a distinct QA/UAT environment before deploying to production." name="Rahul Bhargava" title="CPO, CTO" team="" company="InCred" />


## Technology Startups In India: A Condensed History

A recent study by [Global Entrepreneurship Monitor](https://www.gemconsortium.org/country-profile/69) reported that nearly 20% of workers in India intend to start a business within three years. That statistic sums up the entrepreneurial spirit of the sub-continent and forms the foundation for growth we’re seeing today. India’s role on the international tech scene began in 1968 when Tata Consultancy Services partnered with an American mainframe manufacturer to provide support services. Successive waves of development followed, continuing through the 2010s when an expansion of R&D facilities led to further innovation and expansion of infrastructure, including the creation of Indiastack — a homegrown consent-based scalable architecture that is helping power the next wave of IP-based, deep-tech innovation in India. 

The tech sector has now matured to the point where homegrown incubators and accelerators have taken the lead and are helping fuel the current round of startups. These new startups are building on a solid history of innovation and collaboration — and adding their own unique stamp with cutting-edge advances. Along the way, they’ve developed an understanding of the power of outsourcing and partnering with fellow innovators who may be producing something they can incorporate to further their own product development.

## Indian Startups Address a Range of User Pain Points

With a local business history ranging from outsourced support for mainframes, all the way to cutting-edge R&D, it’s no wonder there are so many interesting and innovative startups in India today. And when you look at the international trend toward componentized development you see why companies with this rich and varied history are able to thrive. To keep it on topic, we decided to highlight a handful of startups that we at Auth0 are already working with to give you a taste of the range of use cases being addressed.

The founders of these organizations saw a need in their communities and decided to create the technology that could address those needs in scalable ways. In partnering with us here at Auth0 to ensure their CIAM needs were met while allowing their in-house development teams to focus their talents on developing the best core product possible, these young organizations are laying the groundwork for sustainable growth going forward.

### InCred: Single sign-on streamlines the development cycle

[InCred](https://www.incred.com/) is a new-age financial services platform that leverages technology and data science to make lending quick and easy for individuals and small businesses. They believe traditional ways of lending tend to exclude those most in need because of outdated, rigid, and inefficient processes. InCred has simplified the lending process, leveraging cutting-edge technology and a sharp focus on serving their borrowers’ unique needs and circumstances to offer a truly superior borrowing experience.

InCred was founded to provide microloans with terms that would allow their customers to thrive while building credit. With zero brick-and-mortar presence, the entire InCred loan process is app-based, yet backed by human-powered, and human-scaled, customer service. When they needed a single sign-on (SSO) solution that would let them set granular controls to limit user access to specific apps, they turned to Auth0.

### LambdaTest: Easy extensibility via a cloud-based testing platform

[LambdaTest](https://www.lambdatest.com/) is a SaaS platform that enables software developers and QA testers to run tests faster and more efficiently on a cloud infrastructure. LambdaTest allows developers to increase their browser coverage and cut down on overall test execution times. With LambdaTest, developers can test their website’s look, feel, and performance on more than 2000 browser, operating systems, and device combinations — all from one platform.

LambdaTest spotted a clear gap in the market for a development testing environment that allowed cross-platform testing in an accessible format. Testing teams across the globe were struggling to scale up their resources to match the fast-paced development cycles global consumers demand. Their platform allows even the smallest bootstrapped startup access to the testing power they need to ensure cross-platform compatibility. And Auth0’s extensive SDK library and easy extensibility pairs well with this model, allowing LambdaTest’s customers to quickly and easily access all of their testing tools smoothly, knowing that we can scale at pace with their expanding business.

### mPokket: Hybrid environment authentication, simplified

With an estimated seven million Indians graduating college each year, [mPokket](https://mpokket.in/) knows it can be hard when you’re just starting out in the world. With their app, students and recent grads can get instant loans to cover bills or rent without the need to provide collateral. In addition, the borrower can set their own custom repayment schedule of up to three months This limited repayment timeframe is to encourage prudent financial planning and careful use of available funds — thus setting them up to be successful savers and investors later in their working lives. By focusing their microlending business on young adults, mPokket aims to help the next generation achieve financial independence earlier.

mPokket makes ample use of Auth0’s Log Streaming capabilities to help ensure compliance with India’s financial reporting standards. They also cite our seamless authentication user experience across their hybrid application landscape as a determining factor in their decision. They are also seeing increased conversions due to the ease of use provided by social sign-on in addition to static user databases. 

### Ontic: Ensuring compliance via integrations

Blending digital with real-world security is where [Ontic](https://ontic.co/) steps in. They provide the first protective intelligence platform that takes digital intelligence and brings it to physical security professionals. This ensures that those in charge of protecting an institution’s most valuable assets, its people, have the most relevant intelligence for early threat detection. Insights from Ontic’s cloud-based SaaS platform allow corporate security and education leaders to better identify pre-incident indicators, perform risk assessments, and mitigate potential threats in order to protect employees, patrons, students, educators, facilities, and schools.

What Ontic sees in Auth0 is a SaaS partner. The time and resources saved by partnering with us are put directly into developing the best core product possible. By allowing their clients to seamlessly integrate with Auth0 single sign-on and Multifactor Authentication, Ontic enables their clients to remain compliant with their own industry regulations without the hassle of creating these integrations internally. And knowing that updates and maintenance of their login flow are in the capable hands of our industry specialists takes one more stress away from their development team.

## One Thing These Startups Share Is a Developer Focus

The history of India’s technology sector has led to a healthy community of software developers with years of experience and often highly specialized expertise in their fields. These companies are using their entrepreneurial tolerance for risk and their innate problem-solving abilities to flourish, even during a global pandemic. 

A global survey conducted by [Auth0](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas) found that when a software company puts their trust in their developers, they spend more wisely when it comes to SaaS products. This, in turn, allows these companies to stay agile and speeds their time-to-market considerably. And with the majority of startup founders coming from a development background, the current crop of Indian startups are very strong in their developer focus, further aiding their successes. 

By allowing their often small development teams to focus on the core product with smart investments in platform as a service (PaaS), [identity as a service (IDaaS)](https://auth0.com/blog/identity-as-a-service-in-2018/), and other SaaS offerings, these startups are positioned to create the disruption they’re looking for, no matter what sector or industry they’re entering. In [Auth0’s recent survey](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas) of global IT managers, development leaders, and technology industry executives, we found that a full 91% of developer respondents feel that having a say in SaaS purchases leads to higher overall job satisfaction (88%) and an increase in productivity (87%). 

This developer-centric model is how Auth0 works as well. We were founded on the idea that by empowering developers to focus on their core strengths, companies are better positioned to come out with the best products possible.

We make it easy by bundling everything you need in a [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) solution into a streamlined package with all the SDKs and APIs your developers need to integrate Auth0 into your core offerings. Download our recent whitepaper on [How Development Teams Purchase SaaS](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas) to learn more. Or [Get in touch](https://auth0.com/contact-us) with one of our specialists today to begin the conversation.

<include src="asides/AboutAuth0" />

India Startups Are Thriving, With More on the Way

jekayinoluwa

I love to deal in the intersection of software, hardware, and human interaction. My strength lies in the seamless combination of my top skills - design, software development, and strategic management.

Software Developer & Technical Writer

Jekayinoluwa Olabemiwo

Learn how to build a book database API with AWS Chalice serverless technology.

How to Create CRUD REST API with AWS Chalice

William Juan

I am a Frontend Developer working primarily in the web and hybrid mobile spaces. The majority of my work has revolved around the Angular ecosystem, including working with other Angular-related frameworks such as NativeScript and Ionic. My passion lies in converting a design into code and achieving a close to pixel-perfect end-product.

Frontend Developer

Improve the User Experience (UX) of an e-commerce application by implementing animations utilizing Angular animations, CSS animations, and Web Animation APIs.

Get Better Angular UX Using 4 Animation Techniques

tyler-nix

Tyler’s professional experience spans engineering, architecture, sales, and product at companies ranging from a small Series B startup to a large Fortune 5 enterprise. He now uses his diverse experiences to build better products at Okta. When he is not scaling digital products, he is pursuing hobbies that inherently don’t scale (especially those outside). He loves hearing his kids laugh while riding bikes, spotting a new bird species, and watching his garden grow.

Product Manager

Tyler Nix

WebAuthn is an exciting technology, maximizing security without sacrificing user experience

Since ancient times, we have used passwords to grant access to privileged information. Guards allow access to buildings if correctly presented with a password. Soldiers exchange passwords and counter password to correctly identify each other. Even 8-year old secret societies allow entry to magical tree forts after declaring the super-duper secret passphrase. And when computers were first invented, how did we decide how to secure them? Passwords! Because, well, that’s all we had.

But if there is anything that we have learned since Robert Morris first started storing login passwords in a hashed form in the 1970s, it is that passwords are messy. They are [hard to remember](https://www.digitalinformationworld.com/2019/12/new-password-study-finds-78-of-people-had-to-reset-a-password-they-forgot-in-past-90-days.html), [easily guessed](https://nordpass.com/most-common-passwords-list/), and [annoying if leaked](https://www.pcmag.com/how-to/what-to-do-when-youve-been-hacked). 

## We Are Getting Better

However, in recent years, we have become more clever in securing digital accounts past just passwords. The two most significant things you can do to make yourself more secure online:

1. Use a [Password Manager](https://www.nytimes.com/wirecutter/blog/why-you-need-a-password-manager-yes-you/) to create and store unique passwords for each of your accounts.
2. Turn on [Multi-factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/) for all your highly sensitive accounts (like your bank and email).

But passwords, those things you and I have to remember if we ever want to use anything on the internet a second time, are still at the heart of the login process. Your password is the single key that proves you are, in fact, you. If a hacker manages to steal it, they can fully impersonate you unless you are one of the [28% of users using two-factor authentication.](https://duo.com/blog/state-of-the-auth-experiences-and-perceptions-of-multi-factor-authentication)

Passwords are messy.

## How Can Webauthn Help

As of January 2021, all major browsers like Chrome, Edge, Firefox, and Safari now support the [Web Authentication API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) meaning we now have the ability to use Public Key Cryptography to register and authenticate users instead of passwords! You might be saying to yourself, “Public Key - what??” Don’t worry. You don’t need to understand the underlying technology to use WebAuthn. If that is you, you can skip to the next section. Otherwise, let’s dive into the details.

Public key cryptography is a relatively old concept but relatively new to user passwords. Ironically, it was invented in the 1970s, around the same time our friend Robert Morris was starting to store hashed login passwords. Public key cryptography uses the concept of a key pair; a private key that is stored securely with the user and a public key that can be shared with the server. These “keys” are long, random numbers that have a mathematical relationship with each other. This technique essentially became the cornerstone that [secures most of the modern internet](https://robertheaton.com/2014/03/27/how-does-https-actually-work/). However, its brilliance of shared secrets was never really applied to managing user passwords... until now!

The Web Authentication API (also known as WebAuthn) is a [specification written](https://www.w3.org/TR/webauthn/) by the World Wide Web Consortium (W3C) and The Fast IDentity Online Alliance, known as FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. WebAuthn allows users to authenticate with public-key cryptography using one of two options:

* Roaming authenticators &mdash; These are removable and cross-platform devices, like a [Yubikey](https://www.nytimes.com/wirecutter/reviews/best-security-keys/) that can be used on multiple devices. To authenticate with a roaming authenticator, you simply connect it to the device (through USB, NFC, or Bluetooth), provide proof of presence (e.g., touching it), and optionally an additional authentication factor like a PIN or fingerprint recognition.
* Platform authenticators &mdash; This option includes the MacBook’s TouchBar, Windows Hello, iOS Touch_FaceId, and Android’s fingerprint_face recognition. Integrated into the device being used, these only work on that device.

![Authentication Flow](https://images.ctfassets.net/23aumh6u8s0i/3b9M189ZcgQtfKSXZEahwv/c4dba7f38fa463f6ffcecb2119117c86/01_auth_flow.jpeg "Authentication Flow")

In the context of this article, we are focusing on Roaming Authenticators, but just know that WebAuthn enables both, opening up a lot of possibilities for secure user authentication in the future.

<include src="WebAuthnMeCTA" group="B"/>

## How to Set up and Use a Security Key

What you will need:

* A laptop or desktop
* A modern browser installed, either Chrome, Firefox, Edge, or Safari.
* A hardware security key, the two best options are [Yubikey](https://www.yubico.com/store/#yubikey-5-series) or [Google Titan](https://cloud.google.com/titan-security-key). Mine looks like this:

![Hardware Security Key](https://images.ctfassets.net/23aumh6u8s0i/7mBoXFhZzqf2vTX3wKothh/f45aa6be66b9b3ab3bc0e862b1d8c735/02_hardware_security_key.jpeg "Hardware Security Key")

**Note:** Before getting started, be aware of what you are about to do. You are about to register a hardware security key as a second form of authentication for your various accounts. **If you do not have this key physically present with you when logging in, you will not be allowed to continue**. It would be wise to enable Two Factor Authentication initially via a Temporary One Time Passcode mobile app like [Authy](https://authy.com/) or using text messages sent to your phone number. This ensures that if you ever lose your security key, you can still use a second form to sign in. If you have not done this yet, you should do this now.

And if you haven’t downloaded and saved your recovery codes in a secure location like a password manager, you should do that as well. Recovery codes can be used to access your account in the event you lose access to your device and cannot receive two-factor authentication codes.

### How to set up a security key with Google

1. Log in to your [Google](https://myaccount.google.com/) account from your browser.
2. Choose Security from the options on the left-hand side.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/jQzUlqMi2cDQgxvWLKzqU/8d68e6505fa8c675d9f538c08517f6a4/03_security_key_with_google_01.jpeg "Security key with Google")

3. Under Signing into Google, select 2-Step Verification.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/5u7erpiTmNNVa43HfUCfWa/568482c8665c6adf3f2460239b333876/04_security_key_with_google_02.jpeg "Security key with Google")

4. Under the Add more second steps to verify it’s you section, choose Add Security Key.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/3BF0d9LDRrQX72RRWn5rBq/bdb3d13d7ee0ce4a083efc453ca7d207/05_security_key_with_google_03.jpeg "Security key with Google")

5. Choose USB or Bluetooth option.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/SfHemm8cvxs61oxZjh8Je/7a5c9edc7a65c9113d06637177512c95/06_security_key_with_google_04.jpeg "Security key with Google")

6. Follow the instructions to register your security key.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/4qoZAYZax8XwiX2EpMT1yv/0d9ce7c036874c7efb90c1e3aeb162a8/07_security_key_with_google_05.jpeg "Security key with Google")

7. Once completed, you should see your named security key as the default option (since it is the most secure) to finish signing in after you enter your password.
![Security key with Google](https://images.ctfassets.net/23aumh6u8s0i/37DgmLP4YkwhLh1WlvKt2t/91e76e7b8a0d68a95c8d5f6534653e3a/07_security_key_with_google_06.jpeg "Security key with Google")

### How to set up a security key with Twitter

1. Log in to your [Twitter](https://twitter.com/) account from your browser.
2. Click on More and choose Settings and Privacy.
![Security key with Twitter](https://images.ctfassets.net/23aumh6u8s0i/1oHkhxSEmtT2wNKY49WpTa/73f77589542621d3bf8e9023f8940643/08_security_key_with_twitter_01.jpeg "Security key with Twitter")

3. Select Security and account access and then Manage your account’s security.
4. Select Two-factor authentication.
5. Click the Security key check box.
![Security key with Twitter](https://images.ctfassets.net/23aumh6u8s0i/5vWoUU7mIS6ouNjBnjMkRV/38f07de9bf5392ba3154ef87828f28f0/09_security_key_with_twitter_02.jpeg "Security key with Twitter")

6. Follow the instructions to register and verify your security key by touching it.
![Security key with Twitter](https://images.ctfassets.net/23aumh6u8s0i/2tMaL6UsrLIOAATKMoCYjx/ff49c458c66f57e8b8b965dba395ec10/10_security_key_with_twitter_03.jpeg "Security key with Twitter")

7. Your key should now be registered with Twitter.
![Security key with Twitter](https://images.ctfassets.net/23aumh6u8s0i/F5eEnT4BOGVILJ6jNtWZA/5262032803c0e0da5093969ffc38d69e/11_security_key_with_twitter_04.jpeg "Security key with Twitter")

### How to set up a security key with Github

1. Log in to your [GitHub](https://github.com/) account from your browser. 
2. Click on your profile image in the top right, and choose Settings.
![Security key with Github](https://images.ctfassets.net/23aumh6u8s0i/2O9KATj48kSAzV9CpXdSXn/896653ff07a309236ceabc091facc645/12_security_key_with_github_01.jpeg "Security key with Github")

3. Select Account Security, then Add.
![Security key with Github](https://images.ctfassets.net/23aumh6u8s0i/7FlPdqNW69mIJ38Dkig2BL/f6671aca1a71a7224fbca573b39bf280/13_security_key_with_github_02.jpeg "Security key with Github")

4. Under Security keys section, register your new security key.
![Security key with Github](https://images.ctfassets.net/23aumh6u8s0i/1Zl3MYe9UiWaA0Ih0hy8hw/f6dac28da88f9a446d4a067b93014aff/14_security_key_with_github_03.jpeg "Security key with Github")

5. Enter a name for this security key.
6. Follow your browser’s steps to register your security key.
7. Insert your security key into your computer and touch it. 
8. Your key should now be registered with GitHub!
![Security key with Github](https://images.ctfassets.net/23aumh6u8s0i/4kua0N7QM8zC3y2PHTypcD/406e672efcffca3df2403f9e629210ed/15_security_key_with_github_04.jpeg "Security key with Github")

It is that easy! You have now made a giant leap in securing your digital life all thanks to WebAuthn. 

On a day-to-day basis, you may not be required to use your hardware key all that often. Services often consider different risk factors to determine whether to require it. Some sites may ask you to enter it when you’re managing what kind of authentication you’re using, while others may ask you to use your key only when you’re logging in from a new computer.

## How to Set up Security Keys for Your Company

If you manage a company’s customer identity access management, then giving users more secure ways to protect their accounts can drastically reduce your risk. One of the easiest (and most secure) ways for you to implement WebAuthn with Security Keys for your website is allowing Auth0 to manage it for you. 

A Beta release of Auth0 with WebAuthn support for Security Keys is available starting today. You can enable the second factor in the WebAuthn with Security Keys MFA configuration section of the Auth0 admin dashboard:

![Security Keys for Your Company](https://images.ctfassets.net/23aumh6u8s0i/4u8PPLPBkktBasuyA5rfJW/baf9ac172457257001902a51a850dad4/16_security_keys_for_your_company_01.jpeg "Security Keys for Your Company")

After it is enabled, users will go through the enrollment flow below. At some point, their browser will show a native dialog to ask users to engage the security key. In the example below, we show the Android dialog:

![Security Keys for Your Company](https://images.ctfassets.net/23aumh6u8s0i/67mLa4gSwO48DW3SSepofu/00cf7adc623946693f92661cb95c3b97/17_security_keys_for_your_company_02.jpeg "Security Keys for Your Company")

The next time they login, the flow will look like this:

![Security Keys for Your Company](https://images.ctfassets.net/23aumh6u8s0i/6TWq0ebOknQ41urkuqrKQU/9cfaa0365656a2a5df489f86b64ba5fc/18_security_keys_for_your_company_03.jpeg "Security Keys for Your Company")

## Passwordless Future

Now let me give a fair warning, we are still on the cutting edge of this technology. Even though browsers now support it, most companies have been slow to adopt WebAuthn, and where there is support, it is only used as a second form of authentication. In other words, we are still a few years from seeing true passwordless user authentication, but it is a start - a very promising start.

What we need is more people insisting that companies start implementing WebAuthn as a primary form of authentication. And the best way to do that is by demonstrating there is public demand for such feature requests by utilizing what is currently offered today.

WebAuthn is an exciting technology, and Auth0 is committed to providing the best possible implementation, maximizing security without sacrificing user experience. Please [try our Beta](https://auth0.com/docs/mfa/configure-webauthn-with-security-keys-for-mfa) today and let us know what you think on our [Feedback page](https://auth0.com/feedback) or in the [Auth0 Community](https://community.auth0.com/) .

<include src="asides/AboutAuth0" />

Using WebAuthn to Secure Your Digital Life

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Okta and Auth0 address a broad set of identity use cases and the acquisition will accelerate the companies’ shared vision of enabling everyone to safely use any technology, shaping the future of identity on the internet



Okta, Inc. (NASDAQ:Okta) announced on 3/3/2021 that it has entered into a definitive agreement to acquire Auth0 in a stock transaction valued at approximately $6.5 billion. Together, Okta and Auth0 address a broad set of identity use cases, and the acquisition will accelerate the companies’ shared vision of enabling everyone to safely use any technology, shaping the future of identity on the internet. 

Auth0 will operate as an independent unit inside of Okta, and both platforms will be supported and invested in. As a result, organizations will have a wider breadth of identity solutions to fit their unique needs. Okta and Auth0’s comprehensive, complementary identity platforms are robust enough to serve the world’s largest organizations and flexible enough to address every identity use case, regardless of the audience or user.  

“Combining Auth0’s developer-centric identity platform with the Okta Identity Cloud will drive tremendous value to both current and future customers,” said Todd McKinnon, Chief Executive Officer, and co-founder, Okta. “In an increasingly digital world, identity is the unifying means by which we use technology — both at work and in our personal lives. With so much at stake for businesses today, it’s critical that we deliver trusted customer-facing identity solutions. Okta’s and Auth0’s shared vision for the identity market, rooted in customer success, will accelerate our innovation, opening up new ways for our customers to leverage identity to meet their business needs.”

“I started my career as a developer,” McKinnon added. “Over the years, I’ve seen developers become more important than ever. They are the ones building every experience on the internet. Auth0’s DNA is rooted in developers, and I’ve always admired their sharp focus and leadership in developer-led identity.”

With continued global market tailwinds of cloud and hybrid IT, digital transformation, and zero-trust security, an identity platform has become one of the most critical technology investments an organization will make. These trends have accelerated over the past year as companies of all sizes and across every industry had to pivot quickly to deliver engaging customer experiences online. Organizations everywhere are rapidly leveraging identity to streamline processes, reduce costs, maintain the highest levels of security, and improve customer experiences to drive business growth. Okta and Auth0 are both committed to delivering innovation and value to organizations navigating those transformations. 

“Okta and Auth0 have an incredible opportunity to build the identity platform of the future,” said Eugenio Pace, Chief Executive Officer, and co-founder, Auth0. “We founded Auth0 to enable product builders to innovate with a secure, easy-to-use, and extensible customer identity platform. Together, we can offer our customers workforce and customer identity solutions with exceptional speed, simplicity, security, reliability, and scalability. By joining forces, we will accelerate our customers’ innovation and ability to meet the needs and demands of consumers, businesses, and employees everywhere.”

Learn more about this announcement: [https://www.okta.com/blog/2021/03/okta-auth0-powering-identity-for-the-internet/](https://www.okta.com/blog/2021/03/okta-auth0-powering-identity-for-the-internet/)


Okta Signs Definitive Agreement to Acquire Auth0

Auth0's CPO shares how his team is expanding their global hiring and technical hubs to new locations.

Last week, we announced that two new hiring programs are coming to the Auth0 Engineering and Product Delivery teams in the US: the [Virtual Summer Internship and Junior Engineer programs](https://auth0.com/blog/auth0-launches-virtual-summer-internships-and-junior-engineer-program/). Today, I am delighted to follow up with yet another exciting announcement: **Auth0 is expanding its global talent pool through focused hiring in Spain and Canada**. This hiring strategy will allow us to create new Auth0 technical hubs.

Auth0's global and remote-friendly structure was born out of necessity. Auth0 was co-founded by people who were almost 7,000 miles apart: Eugenio was in the United States (Bellevue, WA), while Matias was in Argentina (Buenos Aires). At Auth0, we've always looked for the right talent regardless of location. As such, the Product Delivery team has employees in over 21 countries.

Historically, we've applied a remote-centric approach to team dynamics, which has been working well for us. However, a key element to our remote strategy and culture is having our domains and functional teams spend time in person in locations where we have offices. We want to continue hiring wherever talent is and create a few intentional hubs that would facilitate teams coming together face-to-face when needed without traveling thousands of miles to our main offices and hubs in Bellevue or Buenos Aires. 

## We Are Hiring in Spain and Canada!

With the goal of expanding our talent globally, we are focusing on hiring in Spain and Canada to continue building on the fantastic momentum we've had so far. We evaluated over a half dozen countries that aligned with our company strategies. We then realized that we've already been building talented teams with people located in Spain and Canada over the last few years.

[Carolyn Moore, Auth0's Senior Vice President of People](https://auth0.com/blog/authors/carolyn-moore/), reinforces the impact of this strategy in her ["Rethinking Your Workforce Strategy"](https://auth0.com/blog/rethinking-your-workforce-strategy-a-look-at-culture-in-2021/) blog post: "It is critical to be intentional about your workplace cultures and nurture them whether you are in person or not. . . Understanding how we can build better career opportunities in a remote workplace is key for the future of our workforces." 

While we remain remote-centric, our additional hiring focus in Spain and Canada will allow us to accomplish the following goals:

* **Focus on team health and wellness**: Building local hubs in centralized time zones allows for more frequent in-person meet-ups and training to combat screen fatigue and some of the downsides of remote working. Hiring a significant number of people in targeted areas can help us create work schedules that promote a healthier work-life balance. 

* **Amplify our Diversity and Inclusion goals**: A renewed focus on building our teams outside of the United States reinforces our mission to welcome a culturally broader group of individuals with unique backgrounds and skillsets.

* **Refine our remote-centric Recruiting, Hiring, and Training practices**: We haven't decided yet when we will open our physical offices or hubs in these new locations. However, we will always remain true to our remote practices and flexibility. We will continue to use these expansion opportunities to iterate and improve the full Auth0 employee lifecycle experience. 

## Join Us Next Week to Learn More

As we expand our presence in the talent markets of Canada and Spain, we will be running a series of virtual tech talks, webinars, and live Q&As to help local talent learn more about Auth0 and to connect with our organization.

Next week, **we will host a Spain tech talk** with [Ana Cidre, Senior Developer Advocate Engineer](https://auth0.com/blog/authors/ana-cidre/), and [Matias Woloski, CTO and co-founder](https://auth0.com/blog/authors/matias-woloski/), about remote work and the founding story of Auth0. **The virtual event will take place on Thursday, February 25, 2021, at 6:30 PM local time (GMT+1). [Please click here to register for this virtual event hosted in Spain!](https://www.eventbrite.com/e/auth0-tech-talk-tickets-139959800531)**

![Auth0 Tech Talk in Spain](https://images.ctfassets.net/23aumh6u8s0i/6dfN0bkiWxD3fveAQmYkbH/d24b2cd81a79630503972e941624820b/tech-talk-auth0-hiring)

> What time is GMT+1 for you? [Click here to find out](https://time.is/GMT+1).

Start exploring our open roles in these new locations today! Check out our [job openings in Spain](https://auth0.com/careers/positions?locations=Remote%20-%20Spain) and our [job openings in Canada](https://auth0.com/careers/positions?locations=Remote%20-%20North%20America).

<include src="asides/AboutAuth0" />

Auth0 Is Hiring in Spain and Canada!

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Auth0 replaces in-house authentication solution to support rapid global adoption of tax automation and technology solutions

**BELLEVUE, Wash. – Jan. 26, 2021** – The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has been selected as the authentication provider for [Vertex](https://www.vertexinc.com/), Inc. (Nasdaq: VERX), a pioneer in tax automation and a leading global provider of indirect tax software and solutions. Having recently [completed an IPO](https://www.vertexinc.com/company/news/vertex-announces-pricing-initial-public-offering), Vertex will use Auth0’s identity and authentication solutions to manage and secure access to the Vertex platform.

Vertex helps more than 4,000 customers across 130 countries worldwide simplify tax complexities and digitally advance their business. The Vertex platform provides a comprehensive, integrated suite of tax technology solutions, including tax determination, compliance and reporting, data management, and document management. Vertex serves more than half of the Fortune 500 companies, along with the top tax, accounting, and consulting firms. 
 
To aid the company’s strategic priorities and digital transformation efforts, Vertex replaced its in-house identity management solution with the Auth0 identity platform. Auth0’s solutions help secure the authentication and authorization to Vertex’s applications&mdash;which help businesses efficiently manage end-to-end tax operations for customer transaction events&mdash;and help Vertex manage its user authentication experience. 
 
“The rapid changes taking place in today’s global business, technology, and regulatory environments demand intelligent solutions that are secure and scalable,” said Steve Wasserman, Principal Architect at Vertex, Inc. “Identity management is a critical component to any transformation process, and having a proven identity expert like Auth0 allows us to confidently serve our growing customer base.”

“As a trusted leader in tax technology, Vertex is instrumental in calculating the tax for businesses while removing the many hurdles surrounding tax obligations and global commerce,” said Ghazi Masood, SVP of Americas for Auth0. “The security of these transactions is paramount, and Vertex understands the role authentication plays in that process. We look forward to aiding the Vertex team and its customers with their digital priorities to drive long-term success.”

<include src="asides/AboutAuth0" />

### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Vertex Selects Auth0 to Help Businesses Deliver Secure Tax Solutions

How CAPTCHA technology got to this point, and why it’s not going anywhere.

“I’m not a robot” seems like it should be the easiest thing in the world to prove. But if you’ve ever found yourself squinting over a CAPTCHA, trying to pick out photos of crosswalks, you know it’s not as easy as it sounds.

![ReCAPTCHA Example](https://images.ctfassets.net/23aumh6u8s0i/43tITlloB61ioCbc1QQseN/4f5bed888e366d64c204033a65a47aaa/1_recaptcha_example)

CAPTCHAs are designed to guard websites against harmful bots. When they’re properly employed, they’re a useful defense against spam and fake accounts. But CAPTCHAs (and the bots themselves) have become so sophisticated that the tests can end up stymying human users.

The growing consensus is that web designers need to provide the right kind of CAPTCHA and use it only under specific circumstances. Otherwise, CAPTCHA comes at a cost to user experience (UX) and accessibility.

Here, we’ll dive into how CAPTCHA evolved to its current state and discuss what we can do to increase its usefulness and decrease its frustration.

## The Evolution of CAPTCHA and UX

To understand the tension between CAPTCHA’s security goals and UX, you first must understand its (surprisingly fascinating!) origins and evolution.

The term CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. This rather tortured acronym references Alan Turing’s famous [Turing Test](https://www.uipath.com/blog/can-robots-think-the-turing-test-and-rpa): our ability to gauge the sophistication of artificial intelligence based on a human’s ability to differentiate a human from a robot.

### CAPTCHA’s origins

CAPTCHA was created in the early 2000s to combat the epidemic of bots that were spamming early search engines and clogging the internet. Credit for its invention is disputed, but researchers at Carnegie Mellon University certainly pioneered its use. The original CAPTCHA took the form of text warped past the point that computers could decipher while still being (mostly) legible to human beings. The challenges also served as gatekeepers for all users of a particular webpage, instead of being presented to only suspicious users. There were early concerns that the technology presented accessibility challenges, but people soon became accustomed to the little checkbox that proved their humanity.

![Match The Characters](https://images.ctfassets.net/23aumh6u8s0i/1BcQnEZcM6QvnxUVk0ofJj/bda99ac8486d2ebff6e0d4d1f164a6d9/2_match_the_characters)

### Putting CAPTCHA (and users) to work

Soon, CAPTCHA’s developers realized that the technology could be used for something more useful than just making users translate meaningless distorted text. They developed [reCAPTCHA](https://www.google.com/recaptcha/about/), which put users to work digitizing the New York Times archive since humans could decipher the distorted letters in old newsprint better than computers. In 2009, Google bought reCAPTCHA and put it to work digitizing Google books.

Then, in 2013, Google introduced the [image recognition version of CAPTCHA](https://www.techradar.com/news/captcha-if-you-can-how-youve-been-training-ai-for-years-without-realising-it), using photos from Google Street View. They used this image identification data to train their artificial intelligence to be able to recognize objects more effectively. The more the AI learned, the fewer advantages humans had, so, in effect, Google trained CAPTCHA to render itself obsolete.

By 2014, one of [Google’s machine learning algorithms had a 66% higher success rate at solving text CAPTCHAs than humans](https://www.theverge.com/2019/2/1/18205610/google-captcha-ai-robot-human-difficult-artificial-intelligence), which meant it was time for another evolution.

### CAPTCHA version 3: rise of the machines

Next, Google transitioned to “No CAPTCHA reCAPTCHA,” which, [according to them](https://www.google.com/recaptcha/about/), “uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on your website.” While Google is, as always, secretive about the inner-workings of its bot-detection algorithm, this approach was still a big step forward in employing CAPTCHA only for traffic that appears suspicious.

New types of CAPTCHAs have proliferated in recent years, such as math problems and word problems and forms of CAPTCHA that feel more like games. This variety of CAPTCHA code has helped keep the technology alive since hackers can’t just program a single script that will work on every web page.

![Captcha Game](https://images.ctfassets.net/23aumh6u8s0i/7AyhOqKO8DlN8CT9tlmlR4/e925d52297fbdf6f73b139d2bcd96c1e/3_captcha_game)

Despite attempts to gamify CAPTCHA, many users (and developers) still view it as an annoyance.

## The Pitfalls of CAPTCHA for UX

Throughout its existence, CAPTCHA has been a polarizing technology because, if poorly implemented, it can be both frustrating and ineffective.

The first issue with CAPTCHA is **accessibility**. Early CAPTCHA was a nightmare for people with visual impairments, who couldn’t read the warped characters on the screen. Developers soon added audio CAPTCHA so users could hear the letters instead, but accessibility concerns remained. For example, a 2016 study found that users with learning disabilities had more difficulties and a more negative attitude toward [CAPTCHA tests](http://www.ijello.org/Volume12/IJELLv12p207-223Gafni2796.pdf).

Then there’s the problem of **frustration**. As CAPTCHA challenges have become more complex in order to throw off bots, they’ve become increasingly time- and labor-consuming for users.

[Another 2016 study](https://www.researchgate.net/publication/320655707_CAPTCHA_-_Security_affecting_User_Experience) compared different types of CAPTCHAs. They found that text-based challenges were the most frustrating for users, and math tests had the lowest success rate, and while picture identification and games ranked highest for UX, they also took the longest. Ultimately, they concluded that “none of the existing tests are ideal.”

Finally, there’s the issue of **efficacy**. CAPTCHA has a net positive impact on UX only if it actually works at providing a less spammy internet experience for everyone. But sophisticated bots are increasingly capable of solving CAPTCHA puzzles. In addition, “[CAPTCHA farms](https://www.nytimes.com/2010/04/26/technology/26captcha.html)”&mdash;in which spammers pay human workers to take CAPTCHA tests for pennies&mdash;have been around for years.

To be fair, it’s immensely challenging to devise a test so universal that any human can pass it. Professor [Jason Polakis explained the conundrum to _The Verge_](https://www.theverge.com/2019/2/1/18205610/google-captcha-ai-robot-human-difficult-artificial-intelligence): “You need some type of challenge that works with someone from Greece, someone from Chicago, someone from South Africa, Iran, and Australia at the same time. And it has to be independent of cultural intricacies and differences. You need something that’s easy for an average human, it shouldn’t be bound to a specific subgroup of people, and it should be hard for computers at the same time. That’s very limiting in what you can actually do.”

## Making CAPTCHAs Work for Everyone

For all its potential for misuse, CAPTCHA is still an important tool in bot defense. The key is to employ it only when a user’s behavior is suspicious, and they’ve been flagged as a potential bot.

There are multiple ways to determine this, some of which move beyond the realm of traditional CAPTCHA. For example, “[continuous authentication](https://www.theverge.com/2019/2/1/18205610/google-captcha-ai-robot-human-difficult-artificial-intelligence)” looks for physical cues in user interactions with web pages. Are they filling out web forms with superhuman speed? Are their cursor movements more precise than humans, with our imperfect motor skills?

Web developers can use this adaptive approach in conjunction with CAPTCHA tests. Auth0’s [bot-detection feature](https://auth0.com/docs/anomaly-detection/bot-detection) constantly assesses risk by looking at every IP address interacting with a website and determining the likelihood that it’s a bot. It analyzes the behavior of this IP address across the internet and assigns it a reputation score. If that score is low, the bot-detection engine faces the user with a CAPTCHA. Auth0 tenants who enable this feature can choose from a generic CAPTCHA or use Google’s reCAPTCHA.

![Dashboard Anomaly Detection](https://images.ctfassets.net/23aumh6u8s0i/2s5vyitrsTZfbVzK5anX3H/c66b384a956ce1c026b98089d4a249f9/4_dashboard_anomaly_detection)

This type of use lets CAPTCHA work the way it was intended to, without creating needless obstacles for legitimate users.

In addition, it’s important to implement the right kind of CAPTCHA code: one that assigns tests randomly and doesn’t reuse the same solution. For that reason, it’s inadvisable for developers to write their own CAPTCHA script or use a free plugin without knowing its origins.

In the future, the pendulum may swing toward forms of CAPTCHA that identify humans not by our ability to outperform bots but by our tendency to make errors that AI would not. For instance, in 2017, Amazon patented the [Turing Test via failure](http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch-adv.htm&r=1&f=G&l=50&d=PALL&S1=9767263.PN.&OS=PN/9767263&RS=PN/9767263). This type of CAPTCHA presents users with challenging tests that humans tend to fail, and bots answer correctly.

Some websites also use [honeypots](https://dynomapper.com/blog/514-online-captcha-solving-services-and-available-captcha-types), a form of CAPTCHA invisible to human users. This method inserts fields onto a screen that are visible only to bots, tricking them into filling out forms and proving they’re not human.

Finally, CAPTCHA shouldn’t be your only defense against bots. [Social logins](https://auth0.com/learn/social-login/)&mdash;which allow users to verify their identity via their social media account or another trusted identity provider&mdash;are another useful method to restrict website usage to actual human beings.

## CAPTCHA Is Changing, but It’s Not Going Anywhere

As long as there are spammers trying to create fake accounts, there will be a need for technology that separates human users from spambots. Because of that, some form of CAPTCHA technology will always exist, evolving in parallel with AI.

The CAPTCHA of the future probably won’t look anything like the “find the street sign” challenges of today. But for now, these simple tests are still part of a smart bot-detection strategy. Website designers who employ CAPTCHA need to be open to this evolution and always employ the technology thoughtfully to ensure they’re not punishing their human users. 

<include src="asides/AboutAuth0" />

CAPTCHA Can Ruin Your UX. Here’s How to Use it Right

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Global identity management provider recognized as one of the fastest-growing companies in North America for second consecutive year

**BELLEVUE, Wash. – November 18, 2020 –** [Auth0](http://www.auth0.com/), the identity platform for application teams, today announced its inclusion on [Deloitte's Technology Fast 500™](https://www2.deloitte.com/us/en/pages/technology-media-and-telecommunications/topics/north-america-technology-fast-500.html) for the second year in a row. The list ranks the 500 fastest growing technology, media, telecommunications, life sciences, and energy tech companies in North America. 

Auth0's inclusion is representative of the organization's remarkable year-over-year growth since its inception in 2013, and a 70% increase in overall revenue and customer acquisition in 2019 along with continued success through 2020. Auth0 announced a [$120 million round of Series F funding](https://auth0.com/blog/auth0-helping-navigate-through-times-of-transformation/) in July that brought the company's valuation to $1.92 billion and total capital raised to more than $330 million. 

"Being included on the Deloitte Technology Fast 500 for the second year in a row is a great testament to Auth0's growth, despite the challenges that 2020 posed," said Eugenio Pace, CEO, and co-founder of Auth0. "Our placement represents the commitment and accomplishments of our entire team and the support of our loyal customers, partners, and investors. We will continue this dedication and deliver innovative solutions for the persistent problem that our technology is solving."

<include src="asides/AboutAuth0" />

## About Deloitte's 2020 Technology Fast 500™

Now in its 26th year, Deloitte's Technology Fast 500 provides a ranking of the fastest-growing technology, media, telecommunications, life sciences, and energy tech companies &mdash; both public and private &mdash; in North America. Technology Fast 500 award winners are selected based on percentage fiscal year revenue growth from 2016 to 2019.

In order to be eligible for Technology Fast 500 recognition, companies must own proprietary intellectual property or technology that is sold to customers in products that contribute to a majority of the company's operating revenues. Companies must have base-year operating revenues of at least $US50,000 and current-year operating revenues of at least $US5 million. Additionally, companies must be in business for a minimum of four years and be headquartered within North America.

## About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee ("DTTL"), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as "Deloitte Global") does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the "Deloitte" name in the United States, and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see [www.deloitte.com/about](http://www.deloitte.com/about) to learn more about our global network of member firms.

### Media Contacts

Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 
 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Ranked on Deloitte's 2020 Technology Fast 500™ 

jessica-sealby

Jessica drives public relations and global communications efforts for Auth0 across Asia Pacific. Outside Auth0, she frequents Melbourne’s live music venues and chases after her two energetic dogs.

PR Manager - APAC

Jessica Sealby

Identity management serves as essential technology for a global car manufacturer to streamline customer experience

**BELLEVUE, Wash. – November 16, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that Subaru Corporation has chosen Auth0 to provide secure identity management for its newly launched online customer experience, “My Subaru.” Auth0’s secure and frictionless customer authentication experience serves as an essential element in Subaru’s leading approach to customer engagement and meeting the demands of shifting consumer behavior. 

“My Subaru” was designed to support the corporation’s digital transformation efforts and appeal to the industry trend of consumers researching cars online more than ever before. Auth0 will serve as the primary authentication provider for Subaru and will provide assistance in creating a foundational CRM and identity system for managing customer information in a secure manner. Driven by Japan’s Personal Information Protection Act&mdash;which requires companies to show how customer information is being received and managed&mdash;there is a widespread need for proper authentication and digital ID management solutions across the region. Auth0 will assist in compliance with this regulation. 

For Subaru, customer experience could not exist without advanced security, and keeping customers’ personal information safeguarded was paramount. Auth0 was chosen for its ease-of-use, speed of deployment, and extensibility, together with its ability to provide multi-factor authentication (MFA) for even more secure digital engagement. 

“Auth0 is a key factor in our ability to enhance our customers’ online experience, and also provides us with secure identity management. In the near future, we plan to launch a portal service compliant with the Personal Information Protection Act through Auth0’s technology,” said Atsushi Yasumuro, Chief of Business Innovation at Subaru Corporation. “Auth0 is exactly the kind of authentication solution that allows us to achieve Subaru’s vision of ‘Peace of mind & enjoyment,’ giving us the confidence that we are securing customers’ data while offering them the best experience possible.”

The automotive industry is facing a major transition in purchasing behavior, fueling Subaru’s considerable investment in its online offering. The company required an entirely new infrastructure and approach to managing customer information, focusing on integrated CRM software and an identity platform. Auth0 is a vital means for Subaru to build stronger relationships with customers, offer greater post-purchase service, and remain a leader in this highly competitive space.

“We’ve seen enormous momentum around digital transformation in the region. Combined with updated regulations around customer data management, it is more important than ever that identity management becomes a critical piece of any digital foundation,” said Eugenio Pace, co-founder, and CEO of Auth0. “We are honored to work with Subaru on its industry-leading online offering, and look forward to merging identity security with their online presence into one seamless experience.” 

With more than 550,000 users on its owner-oriented “My Subaru” application, Subaru’s goal is to improve consumer engagement and users’ before and after sales experience through universal identification and the identity work in place now with Auth0 will help the company achieve its ambitious goals into the future.

<include src="asides/AboutAuth0" />

### Media Contacts
Jessica Sealby 
Auth0 PR Manager, APAC 
[jessica.sealby@auth0.com](mailto:jessica.sealby@auth0.com)

Auth0 Supports Subaru Corporation with Digital Transformation Shift

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

The technology remains the cornerstone of Auth0 security

On Nov. 5, 2020, Auth0 announced the deprecation of Auth0 Signals brand, the Apility.io API, and the IP Signals API. This change will not impact Auth0’s core product functionality, but it will affect anyone using the Apility.io and IP Signals APIs. Specifically, the API endpoints signals.api.auth0.com and api.apility.net.

The Apility.io and IP Signals APIs will be fully deprecated on **Feb. 8, 2021**.

Signals represented the various datasets Auth0 uses to fuel product capabilities such as [bot detection](https://auth0.com/blog/new-bot-detection-feature-by-auth0-reduces-effectiveness-of-credential-stuffing-attacks-by-up-to-85/) and [breached password detection](https://auth0.com/breached-passwords). These datasets are correlated via our Attack Protection engine to produce confidence scores used by a variety of features. In addition, we offered some of these datasets freely via public APIs.

The technology behind Auth0 Signals remains a cornerstone of our current and future security capabilities for the core Auth0 product. There will be no loss of functionality for the core Auth0 product.

However, to continue operating these APIs publicly would have required significant development resources. These development resources will now focus on improving on creating new security capabilities in our core Auth0 product.

While most of the Apility.io and Signals web properties are being deprecated today, the APIs and [documentation](https://auth0.com/signals/docs/) pages will remain live until Feb. 8, which is the final deprecation date.

### How are you affected, and what action do you need to take?

If you are using the API endpoints [signals.api.auth0.com](http://signals.api.auth0.com) and [api.apility.net](http://api.apility.net), [we recommend reading the Auth0 Attack Protection documentation to find an alternative to your specific use case](https://auth0.com/docs/anomaly-detection). The APIs listed above will no longer be available as of Feb. 8, 2021. Any calls made to these APIs after then will result in a 404 HTTP error or name resolving failure.

While we encourage signing up to become an Auth0 customer to further use the features you’ve grown to rely on, there are several different API services available not affiliated with Auth0 that may fulfill your needs. For example:

**IP address blocklists:**

* [https://www.blocklist.de](https://www.blocklist.de)
* [https://www.stopforumspam.com](https://www.stopforumspam.com)
* [https://www.abuseipdb.com](https://www.abuseipdb.com)
* [http://iplists.firehol.org](http://iplists.firehol.org/)
 

**Domain blocklists:**

* [https://github.com/dpup/freemail](https://github.com/dpup/freemail)
* [https://github.com/ivolo/disposable-email-domains](https://github.com/ivolo/disposable-email-domains)
 

**Email blocklists and verification:**

* [https://www.emailchecker.com/](https://www.emailchecker.com)
 

**IP Geolocation / AS search:**

* [https://ipinfo.io](https://ipinfo.io)
 

<include src="asides/AboutAuth0" />

Auth0 Sunsets Signals

Technology analyst firm KuppingerCole recognizes Signify for outstanding user experience

**LONDON – Oct. 21, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today celebrates its valued customer, [Signify](https://www.signify.com/en-gb), makers of Philips Hue, as the winner of the prestigious KCLive Award: Customer Authentication at KuppingerCole Consumer Technology World 2020.

![Customer Authentication at KuppingerCole](https://images.ctfassets.net/23aumh6u8s0i/3pyMz2SYbkH2t7Asi76zkb/0028f286678377588f613a88e8c88f43/consumer_authentication)

Presented by KuppingerCole Analysts AG, the KCLive Awards honor outstanding projects, standards, or people in the field of identity management, cybersecurity, and artificial intelligence. Signify is being recognized for its use of Auth0 within Philips Hue to build trust and focus on innovation for several million users of the Hue Cloud, the IoT platform that allows consumers to control their home lighting system.

Manufacturing has long been about widgets and margins. But with Philips Hue, Signify now develops experiences on top of its consumer lighting at scale. This strategy required redeploying significant R&D engineering resources, including teams dedicated to maintaining Signify’s homegrown sign-in logic in the Google Cloud Platform. Signify freed up their developers to work on lighting innovation by replacing this component with Auth0. The team then easily fortified its Customer Identity and Access Management (CIAM) project with [Anomaly Detection](https://auth0.com/docs/anomaly-detection), an Auth0 feature that blocks suspicious login activity to protect customers from identity-related attacks.

“Advances in LED have given us the ability to make lights ‘smart,’ and there’s a lot more to explore when it comes to connected home lighting systems and the IoT,” said Etienne Bertou, principal cloud architect, Philips Hue at Signify. “With best-in-class authentication in place, we can focus on pushing the boundaries of innovation and bring new lighting experiences to market that improve consumer productivity, health, and entertainment.”

Auth0’s CIAM solution met all key objectives so that Signify’s R&D management and engineering no longer had to choose between being best-in-class in authentication or rapidly delivering roadmapped features that improve lighting experience for customers.

“Innovation is what happens when you can focus on prioritizing experiences – and authentication just works,” said Steven Rees-Pullman, SVP International at Auth0. “Secure, scalable lighting experiences from Signify are helping to make our lives safer and more enjoyable, businesses more productive, and cities more liveable. Many congratulations to Signify for this well-deserved award!”

Learn more about [Signify and Auth0 on our website](https://auth0.com/case-studies/signify/).

<include src="asides/AboutAuth0" />

### Media Contacts
McKenzie Mayer 
PR Manager, EMEA 
[press@auth0.com](mailto:press@auth0.com)

Auth0 Powers Signify’s Award-Winning Customer Authentication Solution

kerry-ok

Kerry is a marketer that loves to partner with the sales organization. As our SVP for Marketing, she is focused on sharing the Auth0 narrative across the globe. Before Auth0, Kerry spent many years working in B2B Tech at Skytap and F5 Networks. She spends her spare time with her family, dog, working in the yard, and enjoying fantasy football.

Chief Marketing Officer

Kerry Ok

Auth0 teamed with SD Times to discover how organizations evaluate and purchase technology

Over the last decade, most organizations have transformed into software companies. [As Marc Andreessen famously said](https://a16z.com/2011/08/20/why-software-is-eating-the-world/), “Software is eating the world, in all sectors. In the future, every company will become a software company.” Additionally, you often hear expressions like, “In the application economy, software developers reign supreme.” And yet, there is a persistent stereotype that executive management holds all of the power in how organizations evaluate and purchase technology. We wondered: is this still true? Do developers and technologists actually hold more power now? Can the way a company buys technology to be a competitive advantage?	

To uncover the answers, Auth0 partnered with SD Times to survey developers, managers, and executives in application development across the globe. We discovered their views on the importance of SaaS components to their teams and on how they research, evaluate, and purchase these platforms. All of the research findings have been pulled together into the Auth0 Report: [_How Development Teams Purchase SaaS_](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas). Here are a few of the insights we found:

* Companies that innovate fast (speed/frequency of releases) use SaaS components far more often than those that don’t.

![Percentage Apps](https://images.ctfassets.net/23aumh6u8s0i/2yrBhT0Q5hbBt0vreKpASv/8b82d69eec462155337af2fc3c05a3b3/saas_01_percentage_app)

* Outsourcing authentication can help companies reduce their time to market.

![Reduce your Time](https://images.ctfassets.net/23aumh6u8s0i/75kiSjLIngUxTKfqMtPmSh/3b788f7511a3db4a05390352b0fde11d/saas_02_reduce_time)

* Company size does not have a large impact on how they research third-party SaaS components.

![Researching](https://images.ctfassets.net/23aumh6u8s0i/3rA8zPrHqSad7vKs6P75TW/0b88a1e19eb9897d2862802a4823e9d5/saas_03_researching)

* Developers initiate 34% of SaaS component purchases, which is slightly higher than both technology management or technology executives.

![Product](https://images.ctfassets.net/23aumh6u8s0i/3hNCCyr8pdqYAEQXQyXLwX/787f028184e311d74a927f3c9af09b27/saas_04_product)

* Developers care greatly about being consulted in SaaS component purchase decisions. It impacts both job satisfaction and productivity.

![Developers](https://images.ctfassets.net/23aumh6u8s0i/1e7ug06moZrxRfQZaruvHK/5926f8ffff6ca7320524bd0c7f54c6ee/saas_05_developers)

* These are just a few of the insights for the How Development Teams Purchase SaaS report; [you can download the full research report here](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas).

<include src="asides/AboutAuth0" />

How Development Teams Buy SaaS

Tech platform supporting more than 13,000 local pizzerias nationwide relies on scalability and login security with Auth0

**BELLEVUE, Wash. – October 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has been selected as the sole identity and authentication provider for [Slice](https://slicelife.com/), the innovative tech platform powering America’s local pizzerias. Having recently closed a successful [round of Series C funding](https://blog.slicelife.com/slice-raised-43m-in-series-c-funding-to-power-local-pizza/), Slice will use Auth0’s platform to provide a secure login experience for Slice’s five million customers as it continues to scale. 

Slice transforms independent pizzerias with the specialized technology, data insights, and shared services needed to serve today’s digital-minded consumers. Its vast network of more than 13,000 local pizzerias enables these small businesses to compete against major corporate chains and form the nation’s largest marketplace for authentic pizza across 3,000 cities in all 50 states. 

As its network of pizzerias and customers continues to grow, Slice looked to Auth0 to provide authentication for its growing consumer base, already over five million users. After a thorough review of solutions, Auth0 was determined to be a much better fit for scale, security, and lower ongoing maintenance costs. Another big factor in selecting Auth0 was its ability to support bulk migration, eliminating the hassle for end-users to have to reset their passwords.

“Auth0 is the only identity management platform that offers the level of flexibility, security, and customization we need,” said Jason Ordway, CTO for Slice. “Our goal is to provide our users across the country with easy access to their favorite local pizzerias. Auth0 will be a great partner in enabling that while also setting us up for success for our continued growth.”

“Slice is transforming the pizza business, and is helping local businesses move online to keep up with today’s digital demands, especially during the pandemic,” said Ghazi Masood, SVP of Americas for Auth0. “We are thrilled to support Slice’s identity needs and help them seamlessly scale to continue expanding their network.” 

<include src="asides/AboutAuth0" />

### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Delivers Secure Authentication for Slice

Auth0.org leads expansive philanthropic initiatives furthering ‘Secure Access for Everyone’ for technology and inclusive education

**BELLEVUE, Wash. – Sept. 30, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced the launch of [Auth0.org](http://auth0.org/), a social impact program committed to secure, inclusive access for all. Representing an extension of the company's goal of 'Secure Access for Everyone' (SAFE), Auth0.org consists of various philanthropic initiatives for nonprofit organizations and social enterprises, including secure access to technology and equal access to education. As part of the launch, Auth0 also announced that it has joined the [Pledge 1%](https://pledge1percent.org/) movement, and has committed to giving 1% of the company's equity to nonprofits over the next 10 years to help pursue philanthropic initiatives, with initial contributions from co-founders Eugenio Pace (CEO) and Matias Woloski (CTO). 

'Secure Access for Everyone' reflects Auth0.org's strong belief that inclusivity and accessibility are core tenets to prosperity and progress, unlocking human potential, and elevating the human experience. Auth0.org will rely on the company's global network of more than 9,000 customers and more than 700 employees, along with Auth0's resources, to expand upon existing giving initiatives and be a force for good. By leveraging the reach, support, and products of Auth0, Auth0.org will be able to facilitate secure, inclusive access to technology, that aligns with its goal of connecting and improving the lives of people worldwide, regardless of location, race, gender, sexual orientation, disabilities, or religion. 

Auth0.org is engaging with world-changing agents and social enterprises that advance its strong belief in inclusivity and accessibility to make lasting change. To ensure Auth0.org's success in executing that mission, Tides Foundation will serve as its philanthropic partner and charitable home. Since 1976 [Tides Foundation](https://www.tides.org/) has become the leading philanthropic services provider for corporate social impact as well as the nation's largest fiscal sponsor working towards a world of shared prosperity and social justice across sectors. 

Tides will help Auth0.org identify organizations that are in the greatest need of technology access and execute on the program's aligned giving program. 

Auth0.org will focus on three primary areas:

* **Auth0 for Nonprofits:** Auth0 for Nonprofits will provide eligible nonprofit organizations and social enterprises with greater accessibility to Auth0's leading identity management solution. In addition to discounted rates for Auth0's Enterprise offering, nonprofit organizations will also have access to a variety of resources, including free consulting services, implementation guidelines, and customer support. Auth0 for Nonprofits is an extension of existing Auth0 offerings for nonprofit organizations, including the company's efforts to provide [Startup Relief](https://auth0.com/blog/auth0-startup-relief-helping-innovators-battle-covid-19/) for qualifying companies most affected by COVID-19.

* **Auth0 SAFE Fund:** The Auth0 SAFE Fund, a donor-advised fund of Tides Foundation, will make grants to various nonprofit organizations with a similar focus on fighting for secure, inclusive access for all. Auth0's partnership with Pledge 1% underscores its goal of providing funding for qualifying nonprofit organizations for the next 10 years. 

* **Auth0 Employee Giving:** To grow the ongoing philanthropic interests of Auth0's employees, Auth0 Employee Giving will provide donation matching opportunities, encourage volunteering and community outreach efforts, and organize employee events and campaigns.

"We are excited to welcome Auth0 to the Pledge 1% movement and celebrate their incredible leadership as a role model to others. Increasingly, we're noting a strong trend of top companies like Auth0, setting aside equity for social impact," said Pledge 1% Chief Executive Amy Lesnick. "As we face unprecedented challenges from COVID-19, racial injustice, climate issues, and more, companies have an important role in tackling pressing issues of our time. By leveraging equity, in addition to other assets such as time, expertise, product, and its global network, Auth0 is fortifying its commitment with the financial resources required to sustainably address these challenges and drive lasting positive change."

"We are so thrilled to launch Auth0.org as our social impact program, and help facilitate accessibility and inclusivity through technology to connect and improve lives," said Eugenio Pace, CEO and co-founder of Auth0. "Joining Pledge 1% demonstrates our long-term commitment for affecting positive change, and we are absolutely dedicated to our mission of 'Secure Access for Everyone' as both a global company and social impact initiative." 

Ari Schapiro, Senior Director of Self-Service and Social Impact at Auth0 added, "As a more mature company, we have a responsibility to leverage our product, resources, and reach to extend our support to the amazing nonprofit organizations around the world that are using technology as a force for good."

To learn more about Auth0.org and its philanthropic initiatives or how to participate, please visit [Auth0.org](http://auth0.org/). 
 
<include src="asides/AboutAuth0" />

## About Pledge 1%

Pledge 1% is a global movement that inspires, educates, and empowers every entrepreneur, company, and employee to be a force for good. Over 10,000 members in 100 countries have used Pledge 1%'s flexible framework to launch and scale their impact programs and donate 1% of either product, product, staff time, and/or equity to a charity of their choice. In particular, Pledge 1% is helping many companies on the path to IPO pledge equity. Pledge 1% member companies have already ignited half a billion dollars in new philanthropy via their equity pledges, which is proving to be one of the most effective ways of funding social impact work for years to come. To learn more about Pledge 1% visit pledge1percent.org or download the new CEO Equity Playbook today.

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Launches Auth0.org and Joins Pledge 1%

Terraform users can now configure and manage Auth0 with code

**BELLEVUE, Wash. — June 17, 2020 —** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced its partnership with [HashiCorp](https://www.hashicorp.com/), the leader in multi-cloud infrastructure automation software, and integration with HashiCorp Terraform, a tool for centrally deploying and managing cloud infrastructure, safely and efficiently, with code. 

HashiCorp Terraform works with vetted and approved infrastructure and service providers to alleviate the pain of maintaining a large number of cloud assets with a single interface. Now available is the [Auth0 Provider for HashiCorp Terraform](https://www.terraform.io/docs/providers/auth0/index.html), enabling Terraform users to set and update common identity configurations for any applications and APIs using Auth0. 

Thousands of Auth0 customers use infrastructure as code solutions to maintain their cloud architecture at scale, including managing their Auth0 environments. This reduces the risk of making manual mistakes while increasing speed and consistency. The Auth0 Provider allows developers to manage clients, resource servers, rules and rule variables, users, roles, tenants, and custom domains as part of a Terraform deployment.

“Auth0 and HashiCorp customers are rapidly adopting cloud services and delivering innovative customer experiences with speed and reliability,” said Bill Lapcevic, VP of Business Development at Auth0. “Auth0 has been working closely with HashiCorp to offer a reliable and fully supported integration of Terraform with our platform.”

Since the company’s inception, Auth0 has relied upon its loyal and widespread developer community. The Auth0 Provider for Terraform, came from one of Auth0’s Community members, Alex Kalyvitis, who played an invaluable role in facilitating this integration. Solving a need within his company, Kalyvitis created an SDK to connect Auth0’s management API with HashiCorp and wrote the Auth0 Provider for Terraform to complete the integration. Auth0 then worked with HashiCorp to get the Provider listing on Terraform.

The Auth0 Provider for Terraform is now fully supported by Auth0. Please see the [_Use Terraform to Manage Your Auth0 Configuration_](https://auth0.com/blog/use-terraform-to-manage-your-auth0-configuration/) technical blog post to learn how to get started. Auth0 and HashiCorp will also be co-hosting a [webinar on June 30, 2020, at 10 am PT](https://auth0.com/resources/upcoming-webinars/auth0-as-code-with-terraform-webinar?utm_source=auth0blog&utm_medium=announcement&utm_campaign=terraform_webinar), where a technology demo and best practices will be shared.

<include src="asides/AboutAuth0" />

### Media Contacts
Jeana Tahnk 
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com)

Auth0 Announces Technology Partnership with HashiCorp

Seasoned partner executive joins the technology unicorn to grow partner business across APAC; Auth0 also announces new partner in Korea

**SINGAPORE, 30 April 2020:** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, has committed to growing its partner sales across Asia Pacific through the appointment of channel veteran [Jason Teo](https://www.linkedin.com/in/jasonteocj/?originalSubdomain=sg) as the company’s first partner chief in the region.

In this new role as APAC Head of Partnerships and Alliances, Teo’s mandate is two-fold: to build and grow the partner ecosystem in the region; and to execute a partner strategy that will diversify sales and accelerate growth.

Teo has extensive experience helping technology companies expand across Asia and plans to draw upon his vast network and established relationships with partners and system integrators to help support Auth0’s ambitious growth plans in Asia Pacific.

Regional Director for Auth0 in Asia Pacific, Richard Marr, welcomed Teo as an integral part of the company’s growth strategy. “Our differentiated identity platform is seeing adoption in all market sectors and geographies; we’ve experienced consistently high growth across Asia Pacific and invested strongly in the region with three offices and a team spanning South East Asia, Japan, Australia and New Zealand, and India,” said Marr. 

“Building partnerships in APAC is the next important step for Auth0 as we continue to expand locally, and we’re very pleased to have Jason at the helm,” added Marr.

As part of Auth0’s expansion in the region, it has partnered with digital transformation specialist, [OSC Korea](http://www.osckorea.com/). “We are experts in helping our customers to accelerate the digital transformation experience by providing Open Source, microservices architecture, DevOps CI/CD consulting and deployment,” said Jay Kim, CEO at OSC Korea. “To best support our customers, we are working with Auth0 as the identity and authentication solution that can be easily integrated and improve business performance.”

Teo has held leadership positions in various companies including Amazon Web Services, where he was the first Head of Channels and Alliances for ASEAN, launching and establishing its partner ecosystem across the region. His career also includes building the Cloud Business Unit for IBM in Singapore and being the first person on the ground for BlackBerry in Singapore, managing their telco partners across Asia Pacific.

According to Teo, finding the right partners is vital to help Auth0’s customers adopt a cloud-native solution for identity management. He joined the U.S.-based unicorn as he believes Auth0 is creating meaningful technology that can be applied across industries and to organizations of all sizes, from small businesses to large enterprises.

“I am thrilled to be part of such a high-growth company and lead the effort around its [Partner Program](https://auth0.com/partners) expansion in APAC. It takes a whole ecosystem to get our customers up and running, which is why it’s so important we have the interests of all our stakeholders at heart to provide the best possible service,” said Teo.

“We are working with our major global partner network while actively cultivating new local partner relationships across the region, ensuring our offerings are localized and relevant to the needs of each market,” Teo added. 

Auth0 has joined the Amazon Web Services (AWS) [Partner Network](https://auth0.com/blog/auth0-joins-the-aws-partner-network-global-startup-program/) (APN) Global Startup Program and recently announced global partnerships with [Cognizant](https://auth0.com/blog/auth0-expands-global-partner-network-with-cognizant/) and [Globant](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/) as it expands its [Partner Program](https://auth0.com/partners) in APAC and around the world.

<include src="asides/AboutAuth0" />

### Media Contacts
Jessica Sealby 
[jessica.sealby@auth0.com](mailto:jessica.sealby@auth0.com)

Sophie Mayes 
[auth0@keepleft.com.au](mailto:auth0@keepleft.com.au)

Auth0 Hires Former AWS Channel Head, Jason Teo, to Lead Efforts in Asia Pacific

ana-cidre

Ana Cidre is a passionate advocate for the developer community and leads the Developer Advocacy team at Auth0. She's committed to fostering a more inclusive and diverse tech world, drawing on her technical background and strategic vision to improve developer experiences and build meaningful connections.

 

As the founder of GalsTech, an initiative supporting women in tech in Galicia, and through her active efforts to create welcoming spaces for underrepresented groups, Ana's dedication to diversity and inclusion extends beyond her daily work.

 

Ana has a proven track record of building global Developer Relations teams, cultivating active developer communities, and crafting impactful educational content. She maintains a strong connection to the community through speaking engagements and direct interaction with developers.

Ana Cidre

Sam4-square

I'm an Identity nerd with many years of experience as a developer and advocate. I love explaining complex topics clearly and understandably. You can find me on stage at developer events worldwide or simply having great conversations in the hallway. Google has recognized me as a Google Developer Expert (GDE) in the domains of Web Technologies, Security, Privacy, Payments, and Identity.

Principal Developer Advocate

Sam Bellen

Avocado Labs is a platform where we share expert content about web technologies.

On April 17th, 2020 we launched a new initiative run by the Developer Relations team at Auth0: [Avocado Labs](https://avocadolabs.dev). With this initiative, we are on a mission to bring expert content to you, in the comfort of your own home.

## What is Avocado Labs?

Avocado Labs is a platform where we share expert content about web technologies. Our first approach is through online meetups. We will be hosting bi-weekly meetups which consist of two talks per meetup and each edition will be focussed on one technology. Our first episode was about Angular and more specifically Ivy, the Angular compiler. We had two incredible speakers who are renowned specialists in their fields and Google Developer Experts for Angular: Manfred Steyer and Martina Kraus.

In the future, we want to explore other ways of delivering content and figure out what the community is hungry for! We also want to bring communities closer together and find ways of doing it virtually! If you have any suggestions, please feel free to reach out to us on [Twitter](https://twitter.com/Avocado_Labs).

## Why Avocado Labs?

This question is probably the most important. At Auth0, one of our core values is that “We give a sh^\* t” and we really do! The technological community is important to us and we know that it isn’t always easy to go to a conference or a meetup, no matter what the reason might be. We believe that anyone and everyone should be able to have access to quality content and to be able to be part of a community.

We also know that right now the majority of the world is on lockdown which means that people cannot go to physical events, speakers cannot deliver amazing content, and communities cannot gather. We want to help in these times by providing at least some of this. But like mentioned above, this is an ongoing initiative. We won’t stop once things go back to “normal” - Whatever that new normal might be.

![Avocado Labs](https://images.ctfassets.net/23aumh6u8s0i/7vPhXR3e4hzNxn7XdxN8x1/d97fb8dd11cd30179423535a03240a38/avocado_twitter)

## So, What Now?

Why not join us? To follow up on what we’re up to, you can follow us on [Twitter](https://twitter.com/Avocado_Labs). If you’re interested in attending our online events, we suggest that you join our [meetup group](https://www.meetup.com/avocado-labs-talks/). And if you would like to speak at one of our events, please fill out our [call for papers](https://forms.gle/k6gLQc94xTjSunHXA).
Also, any suggestions are more than welcome! Just send us a direct message on Twitter.

## And… What’s Next?

Avocado Labs just took off 1 week ago, so we’re still at a very early stage, but we have plans to grow! One of the first things we want to do is to have our own website where we share all the content and events we are hosting and have already hosted.

Like mentioned before, we want to start exploring other ways of delivering content. That might happen as a podcast, live streams, or maybe even something completely different! This initiative is for the community, so we are all ears and we want to know what you want.

Another part of Avocado Labs that we want to work on is bringing the community together. One of the most valuable parts of in-person events is meeting friends and making new ones. We want to find ways to mimic those virtually, whether it’s through a Zoom call, demos, or maybe even online escape rooms!

We are very excited to see where this adventure takes us and we would very much like to see you come on this journey with us :)

<include src="asides/AboutAuth0" />

Introducing: Avocado Labs

john-brennan

John is an R&D Content Engineer at Auth0. He has nearly a decade’s experience in full-stack software development in a variety of environments, languages, and frameworks. He relishes the challenge of learning hard-to-grasp technical concepts and helping others understand them in a clear, concise manner. His current technical interests are in API design and scalability, Ruby on Rails, accessibility, single-page app architecture, and the ever-changing JavaScript ecosystem. When he's not working, John is usually cooking, doing creative writing, running, or wrangling a toddler.

R&D Content Engineer

John Brennan

Learn techniques for migrating your users from other identity solutions to Auth0

**TL;DR:** This tutorial will walk you through options for migrating users into Auth0, focusing specifically on the challenges you may face when migrating from on-premises identity solutions.

---

## The Basics of Migrating to Cloud Solutions

There may be many reasons that you're migrating away from your on-premises solution. To name just a few:

* The provider might be sunsetting or deprecating the solution you use.
* Licensing fees and vendor lock-in might be proving too restrictive.
* Proprietary or non-standard authentication/authorization approaches might be limiting compatibility with new cloud-based products and services.
* The complexity of managing a suite of identity products yourselves might be proving too cumbersome to maintain.

Regardless of the reasons, Auth0 provides several solutions for migrating user data into Auth0. Whether you're trying to migrate all of your users at once &mdash; a common scenario if a license is expiring or a product is being deprecated &mdash; or more gradually, there are options at your disposal to bring your user data into Auth0's database. Migration can even include hashed passwords, so your users won't have to reset their credentials after their data has been moved! Once migrated, you can rely on Auth0's standards-based approach to authentication and authorization and easy integration with any number of other identity providers. And, if you ever need to extract user data, [Auth0 provides bulk user export as well](https://auth0.com/docs/users/guides/bulk-user-exports).

<include src="ebook-ads/UserMigrationYourWay" />

## Migration Strategies: Bulk vs. Automatic

Auth0 offers multiple strategies for migrating users from an existing application. Bulk Importing users, either via the Management API or the User Import/Export Extension, provides an easy way to shift your existing user base to Auth0 all at once. Bulk import is a great approach when you rely on a soon-to-be-deprecated identity service or application. If time is a critical factor, bulk import allows you to remove your use of the old application as quickly as possible. That said, this migration process can be time-consuming if you have a large set of user data, and it might require downtime for your application while you switch your users over.

> Thanks to a recent release, hashed user passwords can now be migrated through bulk import if they use a [supporting hash algorithm](https://auth0.com/docs/users/references/bulk-import-database-schema-examples#supported-hash-algorithms). Password migration was previously only possible when running an Automatic Migration.

The other option for user import is Automatic Migration via custom database connections. This option only migrates users when they sign in through Auth0, removing the need for a costly all-in-one database migration. On the other hand, this approach takes longer than bulk migration owing to its one-at-a-time approach, so if your identity service is being deprecated, this approach may present some difficulties.

Each of these approaches is explained in more detail below.

## Considerations When Migrating from On-Premises Solutions

The list of on-premises identity providers is by no means small, and going through how to extract your user data from each one would make the length of this article somewhat untenable! Regardless, if you're migrating from an on-premises identity provider to Auth0, there are some caveats to watch out for during the user export process. The exact state and availability of your user data will depend on the specifics of your provider &mdash; Oracle's on-premises offerings, for example, can differ significantly from IBM's in approach, architecture, and storage. However, there are a few general items to consider when looking to migrate your data.

First, not all on-premises solutions offer easy export of their user databases. Some may not offer export options at all; in cases like this, [Automatic Migration](https://auth0.com/docs/users/guides/configure-automatic-migration) of your user data could be an option. This method lazily migrates user data from your existing system to Auth0 when users sign in. This approach may require additional custom work &mdash; for example, if your identity solution isn't available to the public internet, you may need to build or configure a reverse proxy to allow external requests to reach your identity server. A custom solution like this is non-trivial to implement, but a future blog post will walk through this process in detail.

Secondly, the complexity of an on-premises solution can present a challenge. Some identity solutions are sold as a single product but, under the hood, store their information across multiple databases or servers in their backend. An in-depth understanding of how user data is stored in your current provider is critical to a successful migration.

Lastly, it's necessary to format your data correctly. Auth0 expects user data in a JSON-formatted file following a [well-documented schema](https://auth0.com/docs/users/references/bulk-import-database-schema-examples). Your data almost certainly won't come out of your current system in a ready-to-import format, so depending on what state it's in, it'll probably need to be re-shaped to match the schema expected by Auth0's import processes.

These considerations aren't meant to scare you off, but it's important to know what you're getting into when it comes to migrating user data. Depending on your in-house resources, it may be beneficial to [reach out to us](https://auth0.com/partners), so we can connect you with a technology partner to help with the specifics of your migration.

With all that said, let's get to the import approaches themselves!

## User Migration Strategy #1: Bulk Import

As mentioned, if you use an identity solution that's being deprecated or an on-premises identity solution, bulk migration might be the right approach for you. This section will walk through setting up an Auth0 Database and importing users.

First and foremost, you should start by extracting the data from your existing identity solution and reformatting it to match the [Auth0 user import schema](https://auth0.com/docs/users/references/bulk-import-database-schema-examples), which expects a JSON file containing user information. Ultimately, an `email` is the only required field to import a user, though the more complete your data set is, the better off you are.

As mentioned above, bulk import allows importing users' hashed passwords into Auth0. Previously, bulk importing required all customers to reset their passwords once their user accounts had been migrated due to password information not being viable for migration. However, that's now changed: Auth0 now supports importing hashed passwords by specifying a custom password hash in the import schema. The [Import & Export Users documentation](https://auth0.com/docs/users/references/bulk-import-database-schema-examples#custom-password-hash) contains details on how to format password hashes for import. The bulk importer supports [several standard common hashing algorithms](https://auth0.com/docs/users/references/bulk-import-database-schema-examples#supported-hash-algorithms).

Once you format your users' data to match the schema, you're ready to configure your database in Auth0 for storing those users.

First, you'll need to create a Database Connection that will store your imported users in an Auth0 User Store. Head to your [Auth0 Dashboard](https://manage.auth0.com), then click the "Connections" link in the left-hand menu. Click "Databases" in the submenu, and then click the "Create DB Connection" button in the top right of the page.

![Auth0 Dashboard DB Connections Page](https://images.ctfassets.net/23aumh6u8s0i/6002ObMmLMEGodUm26OIr3/b48f44467e1036ba062bc5bf5aea1364/db-connections-page)

In the "New Database Connection" form, give your new database a name like `on-prem-migrated-users`. If your current identity provider requires usernames instead of email addresses for login, you can enable that feature here. You can also specify if you want to disable sign-ups for this user store.

Once you've filled out the form, click "Create" and your database connection is ready.

![Auth0 DB Connection Creation Form](https://images.ctfassets.net/23aumh6u8s0i/3ploRR9cHO9TJqHVOZ0Jtu/81985f02cf4ff8c95f097fc714fc49cf/create-db-connection-form)

Now that you've created your user store, there are two ways to import your user data: using the [Management API](https://auth0.com/docs/users/guides/bulk-user-imports) or using the [Import Users extension](https://auth0.com/docs/extensions/user-import-export).

### Importing Users via the Management API

The Management API provides an easy way to import your users into Auth0 programmatically. To do so, you'll first need to get a token with which to call the Management API.

Go to your Applications page and click the Create Application button. Select "Machine to Machine application" as the type and give it a name like "User Import."

![Auth0 Machine to Machine Application creation form](https://images.ctfassets.net/23aumh6u8s0i/6CIAkPt2IXah17BgcBDYu1/fc0cdfdb74052975b79a6dd36ba769f3/m2m-application-creation)

In the following form, select "Auth0 Management API" in the dropdown of APIs to authorize for this application. Lastly, select the `create:users` and `read:connections` scope in the select box so that you'll be able to create users with the token you generate. Lastly, click the "Authorize" button to create your application.

![Auth0 Machine to Machine Application creation API scopes](https://images.ctfassets.net/23aumh6u8s0i/6zJSQCmw0EmNkbhA8XppqK/9a4023bf1064087e70ad0459b0ffcb80/m2m-application-scopes)

After the form saves, you'll land on the details page for the newly created application.

To call the API using the app you just created, you'll first need to request an access token to include in your user import API call. To do so, open a terminal window and use the following cURL command, filling in your app's values for `YOUR_DOMAIN`, `YOUR_CLIENT_ID`, and `YOUR_CLIENT_SECRET`.

```bash
curl --request POST \
 --url 'https://YOUR_DOMAIN/oauth/token' \
 --header 'content-type: application/x-www-form-urlencoded' \
 --data `grant_type=client_credentials` \
 --data 'client_id=YOUR_CLIENT_ID' \
 --data `client_secret=YOUR_CLIENT_SECRET` \
 --data 'audience=https://YOUR_DOMAIN/api/v2/'
```

These values can all be found on your application's details page, under the "Settings" tab:

![settings tab on Auth0 application details page](https://images.ctfassets.net/23aumh6u8s0i/6GKcFxwf0VfaN2oemVR9Wm/2b69f5d6771fceafb16663f32dc48d4f/get-application-details)

> For an easy way to get the proper parameters set, you can go to the [Management API Docs](https://auth0.com/docs/api/management/v2/get-access-tokens-for-production#get-access-tokens) and sign in to copy the exact cURL request you'll need to request an access token.
>
> ![access token cURL command from Auth0 docs](https://images.ctfassets.net/23aumh6u8s0i/zr8zE0lx4Rkqa6H3HCbBr/ec086e4bf496760002c2aa85da6d542a/quick-start-token-from-docs)

With your token in hand, the next piece of information you'll need is the ID of your database connection. You can retrieve this with a request to the Management API's `connections` endpoint.

If you're going through the API, use the following command:

```bash
curl --request GET \
 --url 'https://johnbrennan.auth0.com/api/v2/connections?name=on-prem-migrated-users'
 --header 'authorization: Bearer MGMT_API_ACCESS_TOKEN'
```

You'll need to grab the `id` field from the JSON payload that's returned.

Now that you have the token and database ID, it's just a matter of making a cURL request to the Management API with your token and the JSON file of your users. Use the following command:

```bash
curl \
 -F users=@USERS_IMPORT_FILE.json \
 -F connection_id=CONNECTION_ID \
 -H 'authorization: Bearer MGMT_API_ACCESS_TOKEN' \
 https://johnbrennan.auth0.com/api/v2/jobs/users-imports
```

We're using cURL's `-F` flag as a shortcut for setting some basic properties; namely, setting the request type to `POST` and the `content-type` header to `multipart/form-data`.

Note that, when replacing `USERS_IMPORT_FILE` in the command above, you can either use your computer's absolute path to the user data file (e.g., `@/users/johnbrennan/documents/users.json`) or, if you're calling cURL from the same directory as the file, you can reference it as a local file (e.g., `@users.json`.)

If all goes well, you should get a JSON payload back as a response:

```json
{"type":"users_import","status":"pending","connection_id":"con_v70Bv0ocb8dwTf92","connection":"on-prem-migrated-users","created_at":"2020-03-20T04:56:19.475Z","id":"job_wnt1clHt6VpGs7Lx"}
```

This response indicates that a long-running job has been kicked off to import your users. You can check the status of the job by calling the `/api/v2/jobs/{id}` endpoint, using the `id` property from the JSON response above in the URL.

Once the job is complete, you can head to your Auth0 dashboard to see your imported users. Open the "Users & Roles" section in the lefthand menu and click "Users." Any user you've imported should show in the list; if you have multiple database connections in your Auth0 Tenant, you can filter users by their database connection in the search bar, selecting "Connection" in the "Search By" dropdown to the right of the text area.

![Auth0 users page using connection filter](https://images.ctfassets.net/23aumh6u8s0i/KwjGV6Qf5q7ttHAxTV2xj/ce8155a3c56f025decf6dae3d13c8bf0/filter-users-by-db-connection)

### Importing users via Import Users extension

The other option for Bulk Migration comes in the form of an [Auth0 Extension](https://auth0.com/docs/extensions) called [User Import/Export](https://auth0.com/docs/extensions/user-import-export). Extensions are &mdash; as the name suggests &mdash; scripts and applications that extend the functionality of Auth0. The User Import/Export Extension is built and maintained by Auth0, but it does require installing and authorizing it on your tenant.

To install the extension, head to your [Auth0 Dashboard](https://manage.auth0.com) and click "Extensions" in the left menu. Once on the page, type "import" into the search bar. The "User Import/Export" Extension should be the first result.

![Auth0 extensions page using name filter](https://images.ctfassets.net/23aumh6u8s0i/3X4sOsP1UaKzhE9nP0UQJY/cf0f06df82aa412a0aa7d7ae3250edbc/filtered-list-of-extensions)

Click the extension to open the confirmation screen for adding the extension to your account. Here, you'll see what scopes the extension is requesting on the Auth0 Management API. Click "Install" to start the process.

![Auth0 Extension installation form](https://images.ctfassets.net/23aumh6u8s0i/3ID8NSAyDVT0Ma5OnCXpzA/11cc71796bf9f7ab9cdb01f34d376b83/extension-installation)

Once installed, you can easily access the extension under the "Installed Extensions" tab on the main Extensions page.

![list of installed Auth0 extensions](https://images.ctfassets.net/23aumh6u8s0i/uebHdTsVMEwk5uGwLOtOo/cc2f4c1b6ff07ea9a6fb5d8795c5100d/installed-extensions-list)

You'll need to authorize the extension for use with your Auth0 account before using it. To do so, click on the extension's name to open the authorization screen:

![authorization screen for Auth0 extension](https://images.ctfassets.net/23aumh6u8s0i/ECTHNHFmvdcvqF0V1n2aT/83f6705903bef38c4719e44276407851/extension-authorization)

Once authorized, the extension provides a form from which you can upload your formatted JSON file containing user data.

![User Import Export extension upload screen](https://images.ctfassets.net/23aumh6u8s0i/7EBqQvRXECrak1E7Bk2sk9/dd0991349f308d4734dd28f92811c0e7/extension-upload-screen)

For a more comprehensive explanation of the extension and its capabilities, you can check out the [Auth0 Docs page for the User Import/Export Extension](https://auth0.com/docs/extensions/user-import-export).

## User Migration Strategy #2: Automatic Migration

If your current solution isn't immediately being deprecated, [Automatic Migration](https://auth0.com/docs/users/guides/configure-automatic-migration) is a convenient way to migrate users one at a time as they sign in.

As mentioned above, one key consideration with this solution is whether or not your existing identity solution is accessible from the public internet, which is required for Automatic Migration to work. If your user data isn't publicly available, you'll need to do some additional work to hook up a migration solution. Depending on your identity solution, one option is to create a reverse proxy (e.g., using NGINX or serverless functions) that's exposed to the public internet and will reformat and forward requests to your internal identity solution. The specifics are relatively complex and beyond the scope of this post, but we're planning a future post that explores this solution in detail!

Automatic Migration works by writing custom scripts, implemented in JavaScript, that call your existing identity provider's APIs when a user logs in to Auth0. When the script runs, Auth0 checks if the user exists in Auth0's database. If they do, they log in as expected. If they are not, the custom script calls the existing identity store to retrieve the user's information and store it in Auth0's database. This way, users are only migrated when they log in, meaning a seamless transition between identity providers.

![Diagram of Auth0 automatic migration logic](https://images.ctfassets.net/23aumh6u8s0i/52NQ04AL71R5z8aqnWFf5z/7e689450ddc6e170821744eacdb62cdf/migrating-diagram)

As mentioned above, the tradeoff in this approach is the amount of time it takes. Since user data migrates only as a user logs in, infrequent or dormant users may not have their data migrated to Auth0 in a reasonable amount of time.

If you have some time in your migration strategy, you also have the option of a two-stage approach to migration. This hybrid approach involves starting with Automatic Migration to move your existing active users over to Auth0 quickly and seamlessly, followed by bulk importing remaining users after automatic migrations slow down.

## Conclusion

Migrating your identity solution can feel like a daunting task. Even setting aside the business complexities, the act of retrieving user data from your existing system and moving it to a new one can present many logistical challenges. Auth0 aims to lower the complexity of this process as much as possible and, with multiple approaches to data migration, create a seamless experience for your customer base.

Technical Strategies for Migrating Users to Auth0

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Andrea Chiarelli

Learn how to use Web Components technologies to build a login button that works in any JavaScript framework.

Beyond JavaScript Frameworks: Universal Login Button Component

jonathan-keen

I head up the legal function for Auth0 in the EMEA region (Europe, Middle East & Africa). I advise the business on commercial, IP, technology and data protection related legal matters - helping to ensure Auth0's interests are protected and that we remain ahead of the curve in a very dynamic legal and regulatory environment.

Associate General Counsel

Jonathan Keen

AWS, Auth0 set to invest in Kenya’s tech ecosystem


In March of 2019, the active number of [mobile subscriptions in Kenya stood at 51 million](https://ca.go.ke/wp-content/uploads/2019/06/Sector-Statistics-Report-Q3-2018-19.pdf), up from 49.5 million in the previous quarter (and over and above the country’s population of 47.6 million). By June, the Kenyan government allocated 12 billion shillings ($117.8m) to the [Konza Technopolis](https://www.konza.go.ke/) project, a world-class smart city with commercial and residential housing, a data center, and universities for science and information technology. 

Then, in November, Kenyan President Uhuru Kenyatta approved the country’s first data protection law. This is one of the most significant developments in the Silicon Savannah this year, protecting citizens online and further readying the Kenyan tech ecosystem for an opportunity. The move also shows that protecting private data is now considered a sign of global readiness. How ready? The Silicon Savannah tech ecosystem is [valued at over $1 billion](https://www.wired.com/story/kenya-silicon-savannah-photo-gallery/).

## Kenya’s First Data Protection Law

Kenya’s Information Minister Joe Muchero has stated the new data protection law complies with the [EU’s General Data Protection Regulation (GDPR)](https://auth0.com/gdpr/). In reality, such a claim has little practical meaning without a formal adequacy decision for the EU Commission, which currently remains a distant prospect until more detailed legislation is introduced. The law shares a lot of the same features as GDPR, including an independent office to investigate infringements and a maximum fine: 3 million shillings ($29,283) or two years in jail.

Like GDPR, the law governs how consumer data can be collected, shared, and stored. Reuters mentions companies like Kenya Airways, as well as the country’s hospitality and technology sectors will be among those that need to comply with the law.

Where there is data, there will inevitably be data misuse, and the East African nation is no exception. As Kenya’s digital ecosystem has grown, particularly the digital loan and payments market for which it is most widely known, so too have the reports of companies [collecting consumer data without consent](https://qz.com/africa/1712796/mobile-loans-apps-tala-branch-okash-face-scrutiny-in-kenya/) to make decisions about creditworthiness, etc. The new law provides more robust protection for Kenyan citizens from predatory and exploitative practices involving their personal data. 

## Attracting Tech Investment Like AWS

In addition to consumer protections, Kenya’s data privacy law aims to attract investment from other parts of the world in its burgeoning ecosystem. Already, Amazon Web Services ([AWS, and an Auth0 partner](https://auth0.com/learn/aws-auth0-iam-platform/)) has announced it will set up an ‘edge location’ in Nairobi, its first outside of South Africa.

Edge locations deliver content at the edge of the network to customers with lower latency connections. AWS has already established two of these locations in Johannesburg and Cape Town, and announced plans to open a data center in South Africa next year. The latter will give African companies more choice, and ultimately greater control over where personal information is stored and processed, a demand that is being driven by the continent’s nascent [data sovereignty](https://auth0.com/security/) requirements.

Auth0 is also making Kenya and Africa a focus area for 2020, delivering robust, yet simple identity management capabilities to entrepreneurs across the continent. Auth0 looks forward to leveraging its relationship with [AWS as its cloud infrastructure provider](https://auth0.com/resources/whitepapers/aws), to be able to offer African customers a more regional choice in respect to data center locations. 

## Setting the Standard for a Continent

Kenya’s law is the latest in a global movement toward [data privacy](https://auth0.com/explore/data-privacy/). All around the world, the proliferation of consumer data protection legislation is raising the bar for tech companies to design their products with privacy in mind. We expect Kenya’s startup ecosystem with its heavyweights like Safaricom M-PESA and solar energy company, M-KOPA, will embrace this challenge. When mobile subscriptions outpace the total population, investing in privacy is key to growth.


Kenya Passes Data Protection Law Inspired by GDPR

Identity management leader ranked no. 5 in Washington state

**BELLEVUE, Wash., November 14, 2019 —** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it ranked #5 in Washington state and #73 nationally on [Deloitte’s Technology Fast 500™](https://www2.deloitte.com/us/en/pages/technology-media-and-telecommunications/topics/north-america-technology-fast-500.html). The list features the 500 fastest growing technology, media, telecommunications, life sciences, and energy tech companies in North America. 

Auth0’s ranking is due to its growth rate of 1,813 percent from 2015 to 2018. Auth0 has achieved consistent and impressive year-over-year growth since its inception in 2013 and has continued throughout 2019 as well. Earlier this year, Auth0 announced a [Series E funding](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) round of $103M, remarkable business [growth in EMEA](https://auth0.com/blog/auth0-expands-european-presence-with-customers-in-belenux-and-nordics/) and [Asia-Pacific](https://auth0.com/blog/auth0-doubles-revenue-customers-in-apac-australia-new-zealand/), as well as key appointments to its leadership team. 

“Our placement is truly the accomplishment of our entire team from past to present, and the trust our customers have put in our identity management platform since the beginning,” said Eugenio Pace, CEO, and co-founder of Auth0. “We are honored to have earned our spot, and will continue to work tirelessly to innovate our technology offering and be a valued partner to our customers.” 

## About Deloitte’s 2019 Technology Fast 500™
Now in its 25th year, Deloitte’s Technology Fast 500 provides a ranking of the fastest-growing technology, media, telecommunications, life sciences, and energy tech companies — both public and private — in North America. Technology Fast 500 award winners are selected based on percentage fiscal year revenue growth from 2015 to 2018.
To be eligible for Technology Fast 500 recognition, companies must own proprietary intellectual property or technology that is sold to customers in products that contribute to a majority of the company's operating revenues. Companies must have base-year operating revenues of at least $US50,000, and current-year operating revenues of at least $US5 million. Additionally, companies must be in business for a minimum of four years and be headquartered within North America.

<include src="asides/AboutAuth0" />

## About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about learn more about our global network of member firms.

### MEDIA CONTACTS
Jeana Tahnk
Global Communications
Auth0
press@auth0.com

Alexandria Plew
Matter for Auth0
auth0@matternow.com

"tech"