Fediverse

hideshow 6 child comments

parent

[–] joeldebruijn@lemmy.ml 4 points 2 years ago (1 child)

Trusting other peoples identification and authorizattion isnt about sharing accounts and passwords. If user A of server X want to log in at server Y, server Y asks server X if it knows this user A. If so server X handles the password/mfa check and just gives the green light to server Y.

parent

@fediverse @maegul @1984 @mindlight @maegul

[–] Aatube@kbin.social 1 point 2 years ago (1 child)

@joeldebruijn Ah, that makes much more sense. I guess this could be also used for phishing, but that may be unavoidable.

parent

[–] joeldebruijn@lemmy.ml 2 points 2 years ago

True! One of the main building blocks, sadly.

parent

[–] Sean@liberal.city 3 points 2 years ago (1 child)

@Aatube @maegul@hachyderm.io @1984 @mindlight @maegul@lemmy.ml
Couldn't it be like public-private keys such PGP protocols, where the users have the private key and the platforms have the public key? It's seems quite good privacy, some would even say it's "pretty good privacy".

parent

@fediverse @maegul @1984 @mindlight @maegul

[–] Aatube@kbin.social 1 point 2 years ago (1 child)

@Sean Nice pun :D

I don’t think requiring users to use a really long and virtually unmemorizable password (the private key) would be a pretty good idea for a social network either.

parent

[–] Sean@liberal.city 2 points 2 years ago (1 child)

@Aatube @maegul@hachyderm.io @1984 @mindlight @maegul@lemmy.ml
The private key doesn't need to be memorized, it stays saved on the device that the client software is on, allowing the user to integrate mobile device's biometric reader (fingerprint/face/iris/whatever) to confirm identity, or use security key, there are already different ways to implement it that doesn't require pw memorization.

I've got a long unmemorizable string for Firefox sync, Brave, Proton Mail/Pass, it's still more secure than pw memorized

parent

@fediverse @maegul @1984 @mindlight @maegul

[–] Aatube@kbin.social 1 point 2 years ago

@Sean Not all devices support passkeys.

Unmemorizable passwords are not the kind I like to use. I'd rather be able to login on some random incognito guest computer.

@Aatube @1984 @mindlight @maegul@lemmy.ml

parent

[–] maegul@hachyderm.io [S] 2 points 2 years ago (1 child)

Yea I don’t know the best approach to that. Either a separate server for managing IDs. Or you always a principal server that manages authentication for its platform and others within the trusted “circle”. And then, should the principal server fail, you can switch to another server as your principal. Hubzilla/Streams has some process like that AFAIK.

parent

@Aatube @1984 @mindlight @maegul@lemmy.ml

[–] maegul@hachyderm.io [S] 1 point 2 years ago

The key idea is that you can have a single unified identity on all the platforms you want. Signing into multiple platforms doesn’t require a new account every time. And cross posting from one platform to another, under your single identity is easy from every platform.

Then leveraging those features (and an open API), a good unifying client will make that easy.

There must be a way of doing that without fatal security issues or decentralisation.