Comment on Why can't we have a unified API across the fediverse to use in mobile apps?
adonis@kbin.social 1 year agoWhy would there need to be a signature to every post? According to your statement, any service that provides OAuth/JWT would be prone to this fatal flaw, wouldn't it?
cerevant@lemmy.world 1 year ago
No, because the model for ActivityPub is very different than how OAuth is used for authentication. What you describe is like wanting to log in to hotmail using your gmail account, and being able to send and receive e-mail from your gmail address.
It is a fundamental to ActivityPub that a user exists at a domain, and content coming from or going to that domain is sent from / to the relevant server at that domain.