Top all-time · #1084
Ory Corp
Company blog · ory.sh/blogsecurityweb
Ory Corp is the company blog at ory.sh, writing about security and web. Since 2018, 64 different Hacker News readers have linked it 97 times. No feed was found, so read it on the site itself.
Sometimes recommended · 7 of 40 sampled comments recommend it?
Why HN links it
HN readers point to ory.sh as an open-source, self-hosted option for authentication, identity and OAuth/OIDC, naming Hydra, Kratos, Keto and Oathkeeper. Some recommend its docs and tutorials.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Ory delivers identity and access management (IAM) for applications, enterprises, and AI agents. Cloud-native, API-first, and self-hostable.
Most-linked posts?
- /11 people · 12 mentions · first linked 2020-04-14
- /6 people · 7 mentions · first linked 2019-06-10
- /6 people · 6 mentions · first linked 2019-12-03
- /hydra/4 people · 5 mentions · first linked 2021-02-09
- /oauth2-openid-connect-do-you-need-use-cases-examples/4 people · 4 mentions · first linked 2023-04-26
- /keto2 people · 2 mentions · first linked 2021-06-24
- /comparisons/ory-vs-keycloak/2 people · 2 mentions · first linked 2023-04-19
- /2 people · 2 mentions · first linked 2022-02-11
- /case-studies/openai2 people · 2 mentions · first linked 2025-03-20
What Hacker News says?
As I wrote in a sibling comment: Keycloak, for one: https://www.keycloak.org I've also heard good things about Hydra: https://www.ory.sh/hydra/ Depending on your needs, an SSO proxy like Vouch works well for internal services: https://github.com/vouch/vouch-proxy There's also an abundance of libraries for different programming languages to implement authentication or authorisation, lots of them battle-tested by thou…
Comment linking /hydra/
on “Hackers claim to have breached Okta systems”Submitted Approaching Access Control on the Web (Part I) as a story · 149 points
HN discussionYes. Keycloak, for one: https://www.keycloak.org I've also heard good things about Hydra: https://www.ory.sh/hydra/ Depending on your needs, an SSO proxy like Vouch works well for internal services: https://github.com/vouch/vouch-proxy There's also an abundance of libraries for different programming languages to implement authentication or authorisation, lots of them battle-tested by thousands of services. It's not…
Comment linking /hydra/
on “Hackers claim to have breached Okta systems”Submitted OpenAI uses open source Ory to authenticate over 400M weekly active users as a story · 69 points
HN discussionJWTs are frequently stored in LocalStorage which means that any XSS is able to leak the JWT. Cookies, on the other hand, can be configured to be HTTP-Only and inaccessible to JavaScript on the page. That prevents somebody with XSS from leaking the value without a second server-side vulnerability or weakness. In addition, JWTs are impossible to revoke without revoking _all_ sessions. This is the biggest weakness, imo…
Comment linking /docs/kratos/guides/zero-trust-iap-proxy-identity-access-proxy
on “Learnings from 5 years of tech startup code audits”Submitted A guide to securing client-side apps (mobile, native, browser) with OAuth2 as a story · 41 points
HN discussionI'm very interested in Tailscale for both personal and business use-cases, but I'm rather put off by the stark centralization of offered identity providers: Microsoft, Github (Microsoft), Google, okta (?). What are the chances that Tailscale would offer authentication using decentralized/self-hosted identity providers like Ory ( https://www.ory.sh/ )?
Comment linking /
on “Tailscale SSH”Submitted Controlling Access to APIs on Kubernetes with Ambassador and ORY Oathkeeper as a story · 9 points
HN discussionCheck out the [org]( https://www.ory.sh/hydra/ ) family of projects
Comment linking /hydra/
on “Show HN: Clerk – all of user management as-a-service, not just authentication”Submitted How to secure your MCP Servers with self-hosted OAuth2.1 server as a story · 5 points
HN discussionYou've done great stuff with FusionAuth! I ended up using ORY [0] at my startup as we had slightly different auth needs, but FusionAuth was a top contender. It's strange to me that Auth0 has so much market dominance. Are they a case of VCs subsidizing a subpar product, combined with aggressive (and bordering on false) marketing, or do they really have some unique product? Their pricing seems ridiculous to me; I can'…
Comment linking /
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”Submitted Ory Acquires BoxyHQ: Introducing Open Source Ory Polis for Enterprise SAML SSO as a story · 2 points
HN discussionOry ( https://www.ory.sh ) seems to have similar aims, could you contrast? Did you consider their existing code? If you are so inclined also interested in any comparison with https://keratin.tech/ and https://www.keycloak.org
Comment linking /
on “Sick of spending time on Auth, we built an open source 'Stripe for Auth'”Submitted Everything you need to know about secure account linking as a story · 1 points
HN discussionAnyone here using Keycloak for a home setup? I've been considering this v/s https://www.ory.sh/ , which is more OIDC focused and can't decide.
Comment linking /
on “Keycloak: Open-source identity and access management”So the idea is that the site is an OAuth2/OpenID connect provider, but one that actually authorizes/authenticates for a site I obviously don't own (HN). I'm not sure I fully understood your idea but setting this was exceedingly easy with the help of ORY Hydra[0], please check em out. [0]: https://www.ory.sh/hydra/docs/concepts/login
Comment linking /hydra/docs/concepts/login
on “Show HN: Login with HN (Unofficially)”Ory | Open Source Software Engineer (Go, React) | FULLTIME | ONSITE in Munich Germany We build stuff for an emerging cloud infrastructure. It's security, zero trust, hardcore bullet proof engineering. It's Golang, K8S, React, Hashicorp etc. - no more buzzwords! We are looking for people with a broad set of technical skills who are ready to take on some of technology's challenges and work with others to create modern…
Comment linking /
on “Ask HN: Who is hiring? (January 2020)”ORY | Munich, Germany | On Site | FULLTIME We build stuff for an emerging cloud infrastructure. It’s security, zero trust, hardcore bullet proof engineering. It’s Golang, K8S, React, Hashicorp etc. - no more buzzwords! Just drop us a short introductory email to jobs@ory.sh. We believe that great engineering deserves to be paid accordingly. Our open positions (all full-time in Munich, Germany): Software Engineer / Go…
Comment linking /
on “Ask HN: Who is hiring? (March 2020)”possibly https://www.ory.sh/
Comment linking /
on “Keycloak: Open-Source Identity and Access Management”.NET already has an identity platform (ASP.NET Identity) that provides authentication/authorization with various backends. IdentityServer is a token server that speaks OAuth/OIDC and provides federation to other user directories (ASP.NET Identity or Azure Directory or anything else). IdentityServer4 is still open-source and available. There's a new version by Duende with commercial licensing, or various alternatives…
Comment linking /open-source
on “Performance Improvements in .NET 6”https://ory.sh has an open- source self-hosted option Hydra (and a number of other services)
Comment linking /
on “OpenID Connect specifications published as ISO standards”Ory | Open Source Software Engineer (Go, React) | REMOTE We build stuff for an emerging cloud infrastructure. It's security, zero trust, hardcore bullet proof engineering. It's Golang, K8S, React, Hashicorp etc. - no more buzzwords! We are looking for people with a broad set of technical skills who are ready to take on some of technology's challenges and work with others to create modern world class solutions. We li…
Comment linking /
on “Ask HN: Who is hiring? (December 2019)”Maybe another interesting project: https://www.ory.sh/ AFAIK NO SSO here...
Comment linking /
on “Authelia is an open-source authentication/authorization server with 2FA/SSO”Yes! WebAuthn, TOTP, Recovery Codes, MFA Policies - it’s all there :) https://www.ory.sh/docs/guides/mfa/overview
Comment linking /docs/guides/mfa/overview
on “Show HN: Ory Kratos – Open-source identity server written in Go”If you're looking to understand the solution that this and other tools in the suite are meant to address, check the Concepts/Overview, especially the "Solving a specific problem domain" section. https://www.ory.sh/docs/kratos/concepts/
Comment linking /docs/kratos/concepts/
on “Show HN: Ory Kratos – Open-source identity server written in Go”I know stating this silly, but it really bugs me seeing the link below at GitHub repo page. https://www.ory.sh/kratos/?utm_source=github&utm_medium=bann...
Comment linking /kratos/?utm_source=github&utm_medium=banner&utm_campaign=kratos
on “Show HN: Ory Kratos – Open-source identity server written in Go”https://www.ory.sh/docs/guides/manage-identities/import-iden...
Comment linking /docs/guides/manage-identities/import-identity
on “Show HN: Ory Kratos – Open-source identity server written in Go”How does this compare to Ory Kratos, also an open source option - https://www.ory.sh/comparisons/ory-versus-auth0/
Comment linking /comparisons/ory-versus-auth0/
on “Launch HN: Stack Auth (YC S24) – An Open-Source Auth0/Clerk Alternative”If you are interested in seeing what this software package can do, as I was, you might want to check out the quickstart example: https://www.ory.sh/keto/docs/quickstart and an example: https://www.ory.sh/keto/docs/examples/olymp-file-sharing as well as the concepts section: https://www.ory.sh/keto/docs/concepts/relation-tuples as well as their implemented and planned features: https://www.ory.sh/keto/docs/implemente…
Comment linking /keto/docs/implemented-planned-features
on “Ory Keto, open source authorization server based on Google Zanzibar”We did quite a bit of research into this. If you need mostly B2C features I would have a look at Clerk [0] and Supertokens [1] If you are more interested in B2B features we found Ory [2], FusionAuth [3], and good old Keycloak [4]. None of them are fully comparable yet however, which might be the reason why they might get away with their current behaviour. [0] https://clerk.dev/ [1] https://supertokens.com/ [2] https…
Comment linking /
on “Auth0 Verifiable Credentials”
