Algora | Algora TV

COSS Founder Interviews #22 - Felix Magedanz, founder of Hanko.io

Watching now

00:00 Hey Felix, thanks so much for joining us.

00:05 Hi, good to see you.

00:07 Really excited to do this. Thank you for the opportunity.

00:10 I saw a tweet of yours earlier saying that now everyone can have a PASCII login like Google using Hanco.

00:18 Yeah, true, true. I just wanted to get the word out and make it clear. I mean, that's why we do it. That's why we do what we do.

00:29 Yes, sir. And I think people are noticing already and this will be widely, widely used.

00:34 So I'm super excited to start with hearing a little more about your background and then how Hancock got started.

00:51 Yes. So in my previous life, and thank you for asking, by the way, in my previous life, I founded a software agency, basically.

00:57 So we built software for money for very different clients.

01:06 And a recurring theme among most of these projects was authentication and struggle with passwords.

01:12 And basically, we had to build everything from scratch every time.

01:18 And a few years in, I decided, okay, maybe it's time to build a product. I consider myself a product guy, and I like working on things making things better um and uh ideally

01:28 scale those things afterwards and yeah i mean i i thought about um what what can be done what is a

01:37 good product and what is the struggle i personally have and uh this issue with building authentication over and over again paired with my own inability to do passwords right.

01:51 I had one or two passwords I used for the logins that I had.

01:57 And I knew it wasn't right, but I didn't know what to do better.

02:02 And so I thought, okay, maybe that is an issue.

02:06 I should tackle it.

02:09 And that's the background.

02:11 That's how Hanko came to be.

02:13 I love it.

02:14 I love it.

02:15 It's a golden recipe to scratch your own itch.

02:17 I've heard this again and again, and you can't go wrong with it.

02:20 And it's a problem everyone is facing.

02:22 Yeah.

02:24 So what did it look like early on, letting people know about this new project,

02:29 maybe having some first contributors come in?

02:33 I mean, I don't think I told you this before.

02:37 We started as a proprietary solution, focusing on FIDO, WebOS, and Passkeys.

02:45 They weren't called Passkeys back in the day, web auth and pass keys.

02:47 They weren't called pass keys back in the day, a few years ago already.

02:49 And we just thought, okay, when this opportunity comes

02:54 that you don't have to use a password anymore

02:57 on the internet, you can use your devices

02:59 and what your devices are capable of,

03:01 touch ID, face ID, Windows Hello, all those shiny, shiny things.

03:07 And there is a day where you can use all this

03:10 on websites and on apps

03:13 without the user having to do anything,

03:15 having to install anything.

03:18 When this day comes, everyone is going to need it.

03:21 That was how we started this.

03:24 And the thing is,

03:26 with this kind of complex technology

03:28 and ecosystem and infrastructure,

03:30 every browser has to support it.

03:32 Every operating system has to support it.

03:35 And they all have to work together, basically.

03:40 You have to be able to use a path key

03:43 that is stored on your Android phone with your Windows machine, for example.

03:47 So this took a while until it was ready, really ready.

03:52 We had some milestones on the way that looked like now is the time.

03:57 You could use Windows Hello on a website.

04:00 It was pretty fancy, but it was only on this one device.

04:04 So it was not as fast as we

04:08 imagined and so yeah we started as a proprietary solution for financial institutions and telcos

04:17 everywhere maybe where a bit more security is relevant and we wanted to bring this technology to those companies.

04:30 And the thing is, we were too early with that, I guess.

04:36 And so we figured, what can we do today?

04:37 So what can we do today? And we still wanted to follow our initial idea.

04:45 wanted to follow our initial idea.

04:48 So moving away from passwords,

04:51 helping developers and product people to build something that is not dependent,

04:54 to build a login to be specific,

04:56 that is not dependent on passwords.

04:58 While at the same time,

05:01 build something that is valuable today

05:03 and not in whatever distant future where

05:07 passkeys can be used everywhere. That future is now but in the past it wasn't.

05:15 So we decided okay what can we do and we knew we had some time left until the passkeys are there

05:22 and we figured okay what is a known solution

05:26 to the authentication problem?

05:29 And it is an authentication solution

05:31 that really covers everything from account creation,

05:36 from account recovery, from the user profile,

05:40 and it should include UI components.

05:43 So it cannot only be an API solution.

05:47 And so with all the experience we made in the years before,

05:54 focusing on passwordless too early in the market

05:57 and building many demo systems, working with many clients,

06:01 did some pilots with very big companies, by the way.

06:05 But yeah, it was like a nice proof of concept.

06:09 There were always the buts.

06:11 And so we dropped everything.

06:13 Long story short, we dropped everything we've done so far,

06:17 aside from this really this FIDO core that we did.

06:20 FIDO is the protocol behind all this.

06:22 We don't have to go into the details. Just if I drop this word, that's the reason why.

06:28 It's a protocol that powers all this passwordless stuff.

06:32 So we kept the core, or hunker core,

06:37 and we built a full authentication solution on top of it.

06:41 And that is what you can see on GitHub today.

06:44 We started with that a bit more

06:47 than a year ago. Again, with the first line of code on GitHub, building this vision of ours

06:56 that makes sense today and that will make sense in the future. And this is the story of Hanko basically.

07:05 And I mean, right now we just launched the public beta

07:10 of our cloud solution to make integration

07:13 and building stuff with Hanko even simpler.

07:17 That's the idea behind it.

07:18 You can get your working Hanko instance

07:23 with just a few clicks and we take care of everything

07:25 and you pay us a bit for it.

07:28 There's the free instance, of course, as well.

07:32 Yeah, targeting developers all over the world.

07:36 The US ecosystem becomes more and more important

07:39 as we can see from the traffic to our website.

07:43 Passkeys is a big topic over there.

07:46 And recent announcements like the one Google made

07:50 just a few days ago.

07:51 It helps us, of course.

07:54 Wow.

07:55 Thank you so much for sharing this background information.

07:57 I love it.

07:58 I love it.

07:58 And it sounds like you spent years sort of like,

08:01 you know, knitting your sales, putting them up until,

08:04 you know, the window of lack of opportunity hits,

08:07 which sounds like, and the decision to go open source,

08:09 I think has vindicated you.

08:11 So now fast forward to today, the work that you have on your plate,

08:16 your team, how's that going to change?

08:20 And what's on the roadmap?

08:22 Maybe a milestone you might like to share.

08:23 Yeah.

08:24 I mean, like I was saying,

08:27 we are now building an authentication solution basically around one feature

08:32 of such an authentication solution.

08:34 So there's a lot of stuff where we, that is solved.

08:37 That is not rocket science.

08:39 Things like walls integrations for signing with Google and signing with

08:44 Apple.

08:44 We just did that.

08:46 Next on the roadmap is things like SAML for B2B use cases

08:50 where customers of ours have business customers themselves

08:54 and they want to use their directory services or whatever, their Okta.

09:00 And so those customers can use us as well.

09:04 This is a pretty important step we have to make.

09:08 So, so far we only cater to B2C companies more or less,

09:11 or very simple use cases.

09:14 And for that to extend this basically in the B2B space,

09:18 we have to do some of it.

09:20 Again, the Parsky ecosystem is ready now.

09:24 I just, a few days ago, I published a new infographic to Parsky.io.

09:29 That's like the demo and educational page that we run, showcasing where Parsky works and where there are still some missing pieces. And we, of course, always focus on those missing pieces as well

09:46 to basically guarantee an ideal user experience everywhere.

09:53 So we don't want the users of our customers to run into issues

09:59 because there's some fancy technology, but those users can use it.

10:03 This is not a good idea.

10:04 So we have to make sure it works everywhere for everyone.

10:07 And this is something we always spend a good amount of time on doing.

10:13 And from our experience, we also learned that this is like the biggest problem

10:21 to solve with those new authentication technologies. It is not the stuff that has to happen in the backend, the crypto stuff.

10:31 It is not simple, sure, but it is not something you couldn't do if you're smart and know how

10:38 to build software, you can do it.

10:40 But the flows, the user flows and all the handling of what the user wants

10:46 and what happens, this is the complex stuff.

10:49 And this is like our area of expertise, I would say,

10:55 and also where we focused on.

10:57 What else?

10:58 We're building right now,

11:00 we're building mobile SDKs for iOS and Android

11:04 and Flutter and React Native

11:06 because pass keys really shine cross-platform

11:11 and cross-device.

11:13 You can create your account in an iPhone app,

11:16 for example, with a pass key

11:18 and sign into the same provider,

11:21 to the same app, basically on your Mac, for example,

11:23 just with Touch ID. And that's really cool. You don't have to do

11:28 anything to sign in to your account on another device.

11:33 And so from very early on, we knew

11:36 we wanted to extend our offering and also our

11:40 documentation and our SDKs to the mobile world as well.

11:45 Yeah, because it just makes so much sense.

11:48 But a mobile developer probably won't touch our stuff without an SDK.

11:53 So there's a way to do it with the API, but they want an SDK,

11:57 so we are building it.

11:59 This is one of the big next releases.

12:03 That sounds super logical as the next steps.

12:06 And that sounds perfect actually for the DX to support.

12:09 And, you know, with all this work to be done,

12:12 I'm curious to ask at this point,

12:14 if and how you're thinking about like potentially hiring,

12:19 like funding and then the commercial aspect of it,

12:22 which we've talked about the monetization,

12:25 all these things relate.

12:26 So what's your approach as a founder here?

12:29 Are you thinking about it?

12:29 So, I mean, hiring, we are careful right now.

12:35 So we have some funds.

12:36 We just closed the funding round with a very cool partner in Germany.

12:45 This is a software company themselves.

12:48 The big announcement will be on Monday,

12:50 so I can't tell you who it is right now.

12:52 It is pretty cool.

12:54 And they have a very good market access in Europe.

12:58 And they are especially in the enterprise world.

13:02 So we can leverage that.

13:05 That's the plan.

13:09 But still, we are very careful.

13:11 So in the past, we raised some funds

13:14 while we were proprietary already.

13:18 Back in the day, this was very big money for us.

13:21 And we thought, okay, we're a startup.

13:23 Now we have to start up and hire many folks and do many things and not everything we did was so good and the

13:31 money was gone faster than you could then you could count it basically and that was that was

13:38 really a learning for me to be to be very careful with with where you spend the money. We're not bootstrapped, right?

13:46 I don't think it's possible with what we do.

13:49 So you have to build a lot of product

13:50 and you have a lot of, yeah, you said it,

13:53 DX is not simple.

13:55 It's very, it's much effort to have good DX and UX.

14:01 Someone has to pay for it, basically. And the longer this money is there, the better.

14:11 So we are hiring, but very carefully, especially developer relations.

14:20 That's what we want to do.

14:21 So we do what I also have right now.

14:22 So we do it.

14:24 We do it ourselves right now. But I think someone focusing on this community and on the task to look at the product, look at the audience, look at the frameworks and really find the perfect match, find what's missing on the product side, find what we may we may not see say in the next JS world or whatever.

14:48 We don't see everything. And this person hopefully can,

14:52 can sit in between like our audience and and our product and focus on making,

15:00 making us better for this.

15:02 And so this is like the most critical role

15:05 we want to hire right now.

15:07 That's perfect.

15:09 And you give an excellent description

15:10 of what the DevRel business function is

15:14 and what it serves.

15:16 That's amazing.

15:17 Very quick follow-up on the previous note

15:19 that sounded like a word of caution

15:21 for other founders when it comes to fundraising.

15:24 Was it that it was too early

15:26 was it that the pool was not enough or there was clarity missing yeah yeah this i think it's a

15:34 classic example of scaling pre-product market fit we were we were doing fancy stuff it was cool we

15:40 had some big meetings with uh with very big names and with large financial institutions and so on, but not real business.

15:49 So it was in the pilot phase and then they were evaluating stuff and it looked very promising.

16:09 side far too early to like hire expensive sales folks from companies like us-based companies very high salary level as well and we just tried we just tried it and thought okay now is the time

16:18 and hired external marketing agencies to write some content for us so when i when i say this now i i

16:28 almost smile about it i mean it's funny in hindsight but it was it was very serious when

16:33 we did it and we wanted to do our best and we thought this is it and so when we decided to pivot to open source and this like go to market strategy is definitely a reason for that.

16:50 I mean, we are building authentication.

16:53 And for that, you need trust.

16:56 This is like the one thing you need to trust is the authentication stack, probably maybe your database.

17:04 And so you need the maximum amount of trust.

17:08 And we thought, okay, how can we convey that

17:12 the best in the best way?

17:13 And the answer was clear.

17:15 It has to be open source or at least open core

17:20 to guarantee this longevity that comes along with it.

17:23 So if we, for some reason, don't exist in a year,

17:27 folks that decided to go with us can still continue using it forever.

17:32 And so you can take a look under the hood.

17:35 Of course, all these reasons why open source is great,

17:40 they apply to us, of course.

17:42 But for us, it was also like a go-to-market strategy because we have to reach developers and what's better than being open source.

17:52 And that is like the best decision we ever made

18:05 because building software openly and on GitHub

18:10 and with an active community and with feedback from the community

18:14 that is very friendly and that is not, I don't know,

18:19 it completely changes at the moment where you say you're open source.

18:24 Here's the code.

18:25 You can do whatever you want with it.

18:27 Then everyone's friendly to you.

18:29 And this is so cool.

18:31 And we would never go back, I say.

18:34 Never.

18:36 I can't imagine going back and building proprietary software.

18:40 I don't know what happens in the future, but, yeah, it makes so much more sense.

18:45 Absolutely. Absolutely.

18:45 Wow.

18:50 Thanks so much for highlighting all this, for the word of caution earlier about, you know, funding.

18:51 It's a tuition a lot of founders pay to learn.

18:55 And then exactly as you said, I mean, the decision to open source.

18:59 And there's all these different superpowers.

19:01 Trust is one of them.

19:02 And then the go-to-market distribution aspect.

19:05 And I would like to ask a question here

19:07 about distribution for an open source developer tool.

19:10 And a lot of other open source companies

19:12 are building dev tools, super important.

19:14 So you already mentioned you're hiring

19:16 for a developer relations role,

19:18 which is going to help with that.

19:20 And you're targeting, you're speaking with enterprises

19:22 like bigger teams, bigger companies with a budget.

19:25 So if there's maybe any lesson learned so far,

19:30 something from your experience, some advice for other founders,

19:33 what to do or not to do here, how much outbound to do

19:37 or just rely on inbound, and then how you as a founder manage all this, right?

19:41 Because you've got to write code too and speak with all these people.

19:43 It's hard.

19:44 Yeah, I mean, you're juggling

19:48 with your time all the time.

19:52 It's hard. And with open source specifically, with commercial open source, in the end

19:56 you have at least two products, right? You have the open source product with the open

20:00 source community and then you have your commercial product. Things change a little,

20:04 right? You ask for money, you get money, then there's some, I don't know, as soon as you get money,

20:15 right, people expect something from you and this happens.

20:18 So you need to take this into consideration when you decide to go commercial open source.

20:26 And then when you start talking to enterprises and bigger clients,

20:31 it becomes really interesting because the whole thing changes again.

20:34 There are very long sales cycles, very different requirements.

20:40 Things like, for example, GDPR is very important sla has become very important all those things

20:50 that you wouldn't have to care not so much at least for smaller for startup companies for

20:56 example that you that you provide these services to so and you have to also you have to make sure not to not to do too much not to do too many

21:08 things at the same time because then you couldn't do any of those in a good way so for us it was

21:14 also clear that we start with focusing really on this on the the indie dev so to speak or small

21:21 startups that just want they just need a login and we provide a very cool solution for it.

21:27 And that's it.

21:28 So make this very simple, very clear, very fast.

21:32 And we didn't talk to any big corporation for one and a half years,

21:39 not a word, because we knew that it doesn't make sense for what we do now.

21:44 Now, as we've built this foundation,

21:48 we start to talk to bigger companies again

21:51 because we have this foundation.

21:53 We know it works for developers.

21:56 And also in this big corporation, there are developers

21:59 and they play more and more a role

22:02 in the decision-making those of the buying process

22:06 there and yeah we know it's a good idea to to have them on your site but still you have this

22:15 the sale happens usually not through the developers maybe through the cto or maybe a chief senior architect,

22:25 probably not the developer.

22:27 And so things change a little, but yeah, this is like,

22:32 I think we're right at the moment where we focused

22:35 on indie developers and startups and now try to evolve

22:41 our business model to larger customers

22:44 with the help of our investor.

22:47 Luckily.

22:48 Absolutely. And

22:49 it sounds like even for those enterprises,

22:52 for those bigger teams that you can anticipate

22:54 their needs, still

22:56 it would start with a single developer

22:58 there experimenting with a product

23:00 to test it before.

23:02 So you're saying why

23:03 build all those things that those

23:06 teams will need, like, you know, first thing, you should leave them for when you actually have those

23:11 people experimenting too, and tied to the, you know, sort of like the business side of things,

23:17 you're having those conversations then, working on development then and figuring out pricing as well.

23:23 development then and figuring out pricing as well.

23:25 So that's very sensible.

23:29 Would the same hold true for having cloud version?

23:32 Probably not. It has to be in the early things. And how did you approach the decision?

23:34 Because some founders wonder whether the cloud version should come in early.

23:38 Yeah, I mean,

23:42 we heard when we were when we were just open source

23:45 and had the project on GitHub

23:47 and had some quick start guide and the

23:49 Docker containers and everything

23:50 every day we got

23:53 requests for this is too hard

23:55 how do I do it with the YAML

23:57 for my environment whatever what

23:59 should I do and like here's

24:01 the course issue with my

24:03 so

24:04 they struggled a lot with it

24:07 and you can't make it simpler.

24:09 It is, you have to do it this way.

24:11 There's no way around it.

24:13 And I mean, we knew from the beginning

24:16 we wanted to do cloud,

24:17 but this was like every day,

24:20 one more reason or two more reasons at least to do it.

24:24 And so, I mean, the open source project is still in beta.

24:29 And so initially our plan was to bring it to 1.0 and then launch cloud.

24:37 And we decided to do it faster because there was demand for it.

24:41 And this is also, I think, a very important learning that we had. Right now,

24:49 we are doing, I would say we're doing almost nothing that has not been asked. So we really

24:57 hear what folks are saying and focus on that. Because, I mean, we think we know stuff, but we've learned that it's not always true.

25:07 So it is much better to cater to those that already see you and that have questions and that have ideas.

25:19 And then bring this into our decision-making process of how to proceed.

25:25 And it has become our golden rule.

25:28 When there's no demand, someone really has to convince the team to do it.

25:36 That's great advice here, actually.

25:37 Thank you.

25:37 Thank you very much for sharing.

25:39 And now, moving ahead, are you and at this stage, which is challenging, like, are there any people in the ecosystem that you might have reached out to for advice?

25:52 Or do you just kind of like figure it all on your own and being near the customer?

25:58 Just curious if there's other people that.

26:00 I don't know.

26:01 So, again, one benefit of the open source community, it is very friendly and you can reach out to many folks that seem to be pretty busy, but for some reason they find time and help you a great deal. For example, I know the founder of Cal.com pretty well.

26:26 And at the moment where we decided or where we discussed the pivot to open source,

26:34 we had some hour-long discussions about this.

26:40 And I would say it was a big influence and very helpful.

27:00 And for example, another name I can drop is the founder of Greylock, for example, took some time and helped me with the decision making process. So thank you, by the way, for your time here.

27:05 And yeah, that was great.

27:08 So I just asked and they helped.

27:12 That's amazing.

27:13 And couldn't stress that more.

27:15 And I hear it again and again,

27:16 like open source founders do give you time so much.

27:19 And we know how busy Pierre is.

27:22 And he acts almost like a design partner in a friendly way, like spends all that time

27:26 with you.

27:27 Thank you very much for

27:30 these shoutouts and

27:31 if someone would like to