Auth0 vs. Yubico YubiKeys

Auth0 is very well suited for situations where a JSON web token can be used for authorizing APIs, websites, and mobile devices. It's especially useful if the JWT validation can happen at a gateway layer. It's especially useful if you only need to verify the user's email address or mobile number as the passwordless login is easy to implement.

Incentivized

When it comes to authentication and securing access, I recommend Yubico YubiKeys. It comes with phishing-proof MFA that is fast and reliable. In addition, the tap-and-go option ensures fast, secure access, which adds up to a good user experience. The tool reduces the risk of account takeovers and significantly enhances business security.

Incentivized

• Overall we had very good experience with Auth0. It supports industry standard language or technology for integration. Very good performance.
• It's nice to work with Auth0's APIs and they are flexible.
• The management and configuration dashboard is useful and easy to deal with.

Incentivized

• So as I said, the second-factor authentication that it does is really well. The response time is really good and all you have to do is just enter the second factor code and that's about it. Right? So that's the good part about using Yubico YubiKeys.

Incentivized

• Auth0 can be somewhat limiting if you want a lot of control over the design of your authentication flow. Custom branding can be done, but it may be limited depending on how you plan to integrate.
• The Auth0 API documentation has proven confusing at times; a single API endpoint's behaviour will change based on inputs and configured settings (e.g. offline_access). Consequently fields that are advertised as being returned in a response might not be there or have different values if you miss a key detail and it can be difficult to debug when this happens. All information required is available in the documentation but requires some digging.
• The toggle to switch tenants feels a bit odd, it works, but I've had a few instances where I didn't realize I was on a staging tenant looking for something that was on the production tenant. Not a big deal, just something to watch out for.

Incentivized

• It can be about access control because either right now it's just you have access or you don't have access. I think there can be a use case where you are allowed a particular set of servers and not a particular set of servers. I think maybe it's there or we don't use it, but I haven't seen that. I think I've used Yubico YubiKeys at two companies and I haven't seen that. Maybe that's something that can be added.

Incentivized

For our purposes, Auth0 is still one of the best valued RBAC platforms in the market.

Incentivized

As for implementing YubiKey its simple so I don't see us using anything else as we have experienced no issues so fare. Adding these to our environment is still new for us currently but in the transition phase I only see us buying YubiKey. It is highly rated and well known and cost is reasonable so no need to find another solution.

Incentivized

Like in my case, it helps me build a better business by requiring authentication and better login features, as they are needed quickly. It helps me save time by not having to create it from scratch and provides better role-based login and access. One of my most helpful features is SSO (Single Sign On). If the user wants Microsoft-able SSO, Auth0 provides an all-in-one.

Incentivized

I give slightly better than average rating because of the complexity in using a Yubikey. It is not as easy as native push notifications for 2FA products, however, it provides much better strength. Rating this higher or lower would be a disservice to people reading this review. If you are in the market for a hardware 2FA tool, Yubikey will be a great asset in your toolbox.

Incentivized

We have not experienced any issues with availability which is very important when you are dealing with a company that holds the keys to the gate. We have had more issues with availability from our SaaS providers before with authentication but that was on their end. YubiKey has worked every time for us over the course of the last 6 or so months we began testing phase.

Incentivized

We have not seen any lag in loading pages and getting into systems or sites. In comparison to other 2FA and MFA options it is actually faster most of the time to authenticate due to not having to type in. We require users to have long passwords and when there is an option given for password less they jump on it with excitement. As we explore going password less on their PC's the YubiKey is going to make their lives a lot easier to access the resources they need.

Incentivized

There isn't a clear method to get a hold of support when trouble arises if you're on their standard plan. You can file a support ticket and they generally are responsive. I've often been able to find similar questions to the questions I've had when it comes to support in their ticket history, however, some have been closed without a satisfactory conclusion for the original poster.

Incentivized

We have only interacted with support once but it was quick and easily answered. Mostly just questions regarding adding this to certain apps.

Incentivized

I figured it all out on my own with the excellent product documentation provided by Yubico. I even managed to produce a backup YubiKey in case I lost my frequently used one. This was crucial when I temporarily lost the original.

Incentivized

Auth0 is non-evasive and does not require software download. It is user friendly, seamless, and doesn't require additional actions on the part of the user. IBM Trusteer is none of these things and is based on a technology stack that cannot scale in the same way as Auth0. We believe Auth0 provides a superior solution and is well suited for our own technology stack.

Incentivized

We didn’t do a deep comparison with a lot of other vendors, mostly just used built‑in MFA options (like authenticator apps and SMS) before this. Compared to those, YubiKeys are just way harder to phish or bypass. That’s the main reason we went with them. Hardware-based auth felt like a better fit for higher-risk accounts, even if it’s a bit less convenient for users.

Incentivized

For us I feel like the ease of deployment has made this product very appealing, overall this will make the scalability very easy for us to push out once we roll out to our users and the management tools that we have looked at will make the admins like me happy as it is clear and easy to use. The rollout process looks to be very straight forward from the demos that we have looked at regarding the enterprise tools.

Incentivized

• Development time has been allocated to the more core parts of our business.
• We are confident in the security of our user's accounts and their data.
• Auth0's login flows are customizable which means that we don't have to worry about users being confused when logging in/changing their passwords, and we didn't event have to spend that much time configuring this. (Full in-house development for login could take weeks to get right.)

Incentivized

• WebAuthn is an automatic security win, adding hardware keys where your security model calls for it is a natural choice. The automatic support for this makes this easy to integrate into your existing strategy at a reasonable cost/key for the quality.
• For privileged scenarios, the risk reduction opportunity is significant. You can leverage hardware keys for privileged access that integrate well within existing identity platforms (like Microsoft) so roll-out is a simple matter of config.
• The 6 Ps apply here, deployments must be planned carefully to ensure the impacted users are ready. Else you will see key loss, helpdesk demand, etc. Plan the deployment well so that users know what they are doing on day 1.

Incentivized