A "Sign in with fediverse" button?

Submitted ⁨⁨4⁩ ⁨weeks⁩ ago⁩ by ⁨tomatol@lemm.ee⁩ to ⁨fediverse@lemmy.world⁩

Just like apps and websites implement “Sign in with Apple” and Google couldn’t we build some kind of federated authentication provider? Then everyone creates an account there and fedi apps can implement an easy way to authenticate users. Even non fedi apps could use it. I imagine user interaction between different fediverse platforms would be much easier too.

I guess anyone could run an auth instance. Ideally everyone would run their own, keeping your data safe.

Is there something likes this already? Saw some discussion here but not much else socialhub.activitypub.rocks/t/…/712

source

Comments

Sort:hotnew top

HiddenTower@lemmy.world ⁨4⁩ ⁨weeks⁩ ago
Since I’ve moved to a password manager I find these social logins less useful. Personal opinion.

source
- Saleh@feddit.org ⁨4⁩ ⁨weeks⁩ ago
  Yeah, also if the one login gets compromised, oh boy…
  
  Anecdote time. My first e-mail account got hacked. I still had my Steam account attached to it. Now i have a VAC Ban in CS2 because some chinese kid used it for hacking ingame.
  
  source
- z3r0_Geek@lemmy.zip ⁨4⁩ ⁨weeks⁩ ago
  Also doesn’t this comes against the decentralization principles of the fediverse?
  
  source
- tomatol@lemm.ee ⁨4⁩ ⁨weeks⁩ ago
  I agree but I also thought this could solve things like mentioning a user across platforms for example.
  
  source
Impronoucabl@lemmy.world ⁨4⁩ ⁨weeks⁩ ago
Yes and no.

Decentralized IDs exist, but will almost never be accepted by any large reputable institution.

Why trust every indie site to be 100% truthful, and definitely not full of malicious haXXors?

source
- tomatol@lemm.ee ⁨4⁩ ⁨weeks⁩ ago
  Just like fediverse works you can federate with the auth providers you want and ban malicious ones.
  
  Lots of lemmy instances chose not to federate with others. I imagine it could work the same way.
  
  source
  - Impronoucabl@lemmy.world ⁨4⁩ ⁨weeks⁩ ago
    Before an instance does something malicious, how do you know it will be malicious?
    
    Even if everyone there running it, & participating is pure of heart, how can you be assured that haXXors won’t simply break in to take advantage of that trust you’ve given them?
    
    Banning bad instances is a reactive stance that only applies after damage has been done. Can you convince the corporate overlords to take that risk? And it only increases as the fediverse gets more popular, and more instances get trusted.
    
    source
Gladaed@feddit.org ⁨4⁩ ⁨weeks⁩ ago
But why? Just use a password manager instead of tying your identity to a Lemmy instance which you do not control.

Having SSO is reliant on having a single trusted server which has your password instead of you maintaining it yourself. This is just an unnecessary risk.

source
- tomatol@lemm.ee ⁨4⁩ ⁨weeks⁩ ago
  I mean a federated authentication server that you can host yourself if you want.
  
  I don’t understand what you mean about using a password manager, you can still do that and your identity is tied to a lemmy instance right now anyway.
  
  source
  - Gladaed@feddit.org ⁨4⁩ ⁨weeks⁩ ago
    My Lemmy instance only owns this account, not secondary accounts on separate websites
    
    source
    -> View More Comments
  - Ulrich@feddit.org ⁨4⁩ ⁨weeks⁩ ago
    
    I don’t understand what you mean about using a password manager
    
    There’s no point in using a password manager in your scenario. It’s redundant.
    
    Also your identity is tied to a lemmy instance right now anyway.
    
    It’s not, actually.
    
    source
- Ulrich@feddit.org ⁨4⁩ ⁨weeks⁩ ago
  This right here ☝️
  
  source
4am@lemm.ee ⁨4⁩ ⁨weeks⁩ ago
Nah mate, I don’t think I want to trust some rando identity server with my login, and self hosting just makes them easy targets.

source
Flax_vert@feddit.uk ⁨4⁩ ⁨weeks⁩ ago
IndoeAuth

source
renzhexiangjiao@lemmy.blahaj.zone ⁨4⁩ ⁨weeks⁩ ago
please correct me if i’m wrong on this. lots of people here saying that it’s not practical because we would have to trust tiny instances that may be malicious. however, what if we make user’s identity provable to anyone, simply by the use of logic? suppose we have a way of generating random proof-theorem pairs (for example, the theorems could be something like “the largest proper factor of n is greater than some m, where m and n are some huuuuuge numbers and n is semiprime”, the proofs could be constructive). we let the identity be the theorem and the password be the proof. hence, anyone is able to verify the indentity by the use of a theorem prover like Agda

source
- 4am@lemm.ee ⁨4⁩ ⁨weeks⁩ ago
  Congrats you just invented passkeys
  
  source
  - renzhexiangjiao@lemmy.blahaj.zone ⁨4⁩ ⁨weeks⁩ ago
    why can’t we use passkeys instead of passwords though? is it just a matter of convenience? if so, maybe there is a way to determine a passkey from a password?
    
    source
    -> View More Comments
gnuplusmatt@reddthat.com ⁨4⁩ ⁨weeks⁩ ago
Id rather just sign in with my gpg public key

source
lostmypasswordanew@feddit.org ⁨4⁩ ⁨weeks⁩ ago
This used to exist. It was called OpenID

source
gon@lemm.ee ⁨4⁩ ⁨weeks⁩ ago
As others have mentioned in the comments, this might not really work because websites/services would have to trust a bunch of tiny, maybe even single-user instances.

I can see a world where sign-in with Fediverse is possible, but only for a select few instances such as .world, .ml, .ee, and a few other highly-moderated servers.

source
- tomatol@lemm.ee ⁨4⁩ ⁨weeks⁩ ago
  I think you’re right. This might be the biggest problem but it doesn’t seem impossible to solve.
  
  I believe it’s actually possible to sign in with mastodon on Pixelfed. Wouldn’t that work for a single user mastodon instance too?
  
  source
  - gon@lemm.ee ⁨4⁩ ⁨weeks⁩ ago
    
    I believe it’s actually possible to sign in with mastodon on Pixelfed. Wouldn’t that work for a single user mastodon instance too?
    
    You’re right. I’m not sure if it works with single-user instances, but I believe it does. This is the sort of thing that is technically possible — I believe ActivityPods aims to do something about it, too — but I don’t know… I guess federation can be a bit of a safeguard for this, like having a list of flagged instances that don’t allow account creation; requiring certain thresholds of account age or activity to be passed; stuff like that. There’s also the fact that, being social media, no instance wants bots to run wild, so that could, itself, be a check on that sort of thing, and it might not be economically viable to just host an instance strictly for bot-login purposes, so that is just an inherent barrier to wrongdoing.
    
    Meh, maybe it’s more feasible than not.
    
    source
    -> View More Comments
nate@social.trom.tf ⁨4⁩ ⁨weeks⁩ ago
@tomatol If Nomadic identities get implemented then yes, I've heard there were somepeople working towards it but haven't heard much since.
Still, not sure I'd be to comfortable using a Fediverse server (especially one not hosted by me) for my identity. I've already lost an account to a SQL database dying, and some swaths of the fediverae are rather quick to ban or defederate.
Nostr and AT do it pretty well, though, using a key pair you control to sign into other services using your account. If something were attempted on the Fediverse this would probably be the best way to go about it.
source