Comment

Comment on Why can't we have a unified API across the fediverse to use in mobile apps?

<- View Parent

adonis@kbin.social ⁨1⁩ ⁨year⁩ ago

logging in with one account into another instance

I'd imagine a OAuth/JWT-like workflow, where pixelfed.social can ask a kbin-API whether my user exists on kbin.social.

If it does, I should be able to post images on the pixelfed app that show my username as @adonis.

source

Sort:hotnew top

Crul@lemmy.world ⁨1⁩ ⁨year⁩ ago

If it does, I should be able to post images on the pixelfed app that show my username as @adonis.

It cannot work as stated because there could be another @adonis accounts in other instances and the only way to prevent that would be to centralize all the signups which goes against the whole idea of decentralization. That’s why the user must be @adonis1@kbin.whatever as it is shown now.

Regarding the OAuth/JWT, again… not an expert, but what I understand is that that kind of integration is much stronger than the current system. AFAIK, it could work as you say, but that would make things much more complex for the servers; you usually provide OAuth authentication for a few services, I don’t know how well that scales. But, who knows, maybe in the future it’s implemented in one way or another.

We should take into account that this technology is fairly new and people are still building on it.

source
- adonis@kbin.social ⁨1⁩ ⁨year⁩ ago
  Sorry but the autoformatting miscommunicated my statement... by @adonis I meant adonis @ kbin.social.
  
  And the domain is always part of the actual userhandle.
  
  Regarding OAuth/JWT, these aren't new concepts. They've been around for while, if not decades.
  
  source
cwagner@lemmy.cwagner.me ⁨1⁩ ⁨year⁩ ago
[deleted]
source
- adonis@kbin.social ⁨1⁩ ⁨year⁩ ago
  Why would there need to be a signature to every post? According to your statement, any service that provides OAuth/JWT would be prone to this fatal flaw, wouldn't it?
  
  source
  - cerevant@lemmy.world ⁨1⁩ ⁨year⁩ ago
    No, because the model for ActivityPub is very different than how OAuth is used for authentication. What you describe is like wanting to log in to hotmail using your gmail account, and being able to send and receive e-mail from your gmail address.
    
    It is a fundamental to ActivityPub that a user exists at a domain, and content coming from or going to that domain is sent from / to the relevant server at that domain.
    
    source