I see your point with Intercom, but it feels like you're arguing that two wrongs make a right. It doesn't make me think MagicBell takes security very seriously, but perhaps I'm just paranoid.
Regardless, the copy on the website is improved. You may also want to add a warning and link anywhere your website documents the "userEmail" option.
On another note, in terms of the implementation here, I'm surprised you're asking users to use HMAC and base64 manually, instead of using standardized JWTs. Did anything in particular motivate that decision?
I quite like the product overall - I think it's very clever how you componentized everything. The security decisions just have me concerned.
I wanted to pile on a little bit here and say this paragraph isn't really comforting to me:
> While unlikely to happen, it is possible for a savvy user to open their browser's developer console, obtain your MagicBell project's API key from your website's source, initialize the widget on their own website with your API key but with a different user's email (if its feasible for them to guess one) and start viewing notifications of that user.
I suspect this was done for developer experience reasons? You seem to know it's not secure to pass in an email directly, especially if anything sensitive is coming across in notifications.
For me at least, allowing the non-HMAC configuration makes me wonder what other security corners have been cut. I'd rather that option didn't exist and the company took a more security-forward stance.
The ski boot industry has been focused on reducing plastic weight / thickness while remaining sturdy. People very much appreciate the innovations there.
The reason I ask is because Cloudflare's "orange cloud" DNS mitigates that protection because it prevents Safari from detecting the cloak. On the other hand, I haven't run into many engineers who think CNAME-cloaking actually hurts privacy in light of Safari's other efforts to partition local storage.
Does Cloudflare think it would be help privacy for Apple to know the final IPs behind orange cloud DNS?
I'm still a bit confused why you're referencing OAuth here and in the launch announcement while also saying "OAuth is different to session management"
Why have you chosen to use OAuth solutions if you're not solving an OAuth problem? How are you sure it's still the right solution? I see some overlap but it's not obvious to me that OAuth methodologies should be applied here.
If I understand correctly, you're having me integrate a library on my backend that manages session cookies.
You've implemented refresh tokens and that seems to be one of your major selling points, but I'm confused what benefit that provides?
I thought the use case for refresh tokens in OAuth was that the user can revoke access from the OAuth provider side. But since the user can't go to SuperTokens and revoke their session, isn't the refresh token functionality superfluous?
Regardless, the copy on the website is improved. You may also want to add a warning and link anywhere your website documents the "userEmail" option.
On another note, in terms of the implementation here, I'm surprised you're asking users to use HMAC and base64 manually, instead of using standardized JWTs. Did anything in particular motivate that decision?
I quite like the product overall - I think it's very clever how you componentized everything. The security decisions just have me concerned.