Working to Decentralize FedCM

Comments

• poVoq@slrpnk.net ⁨5⁩ ⁨days⁩ ago

  Sounds good, but this FedCM seems to be basically a reinvention of Oauth2/OIDC. Even if it brings some minor improvements (credentials storage in the browser or so?), it seems dead on arrival given that there doesn’t seem to be a strong dissatisfaction with how OIDC works. Or am I missing something?

  source

  • erlend_sh@lemmy.world ⁨4⁩ ⁨days⁩ ago

    What you’re missing is that OIDC is innately centralized and FedCM, in particular thanks to this work, isn’t.

    This is all building on or complementing the same underlying OAuth standards, like the CIMD spec that Emelia originally intended for adoption into Mastodon/ActivityPub to set the stage for decentralized OAuth, but it was never brought in. The AT protocol on the other hand adopted it into their decentralized oauth-atproto standard, which is on track to become a protocol-agnostic oauth-dweb standard.

    Anyone who cares about decentralized software should be dissatisfied with how OIDC works. If you wanna use your primary fediverse account to log into other fedi apps, this work is for you.

    source

    • poVoq@slrpnk.net ⁨4⁩ ⁨days⁩ ago

      OIDC isn’t “innately centralized”, thats just how the majority of people use it. And the same will be likely true for FedCM.

      source
    • psycotica0@lemmy.ca ⁨4⁩ ⁨days⁩ ago

      OIDC is innately centralized

      Huh, that’s not my understanding. I was there when it first came out, and the whole point was to allow you to use any URI of your choice as an authenticator. Let’s see what the first line of Wikipedia has to say:

      OpenID is an open standard and decentralized authentication protocol

      Huh. 🤔

      source

      • -> View More Comments
  • julian@activitypub.space ⁨3⁩ ⁨days⁩ ago

    @thisismissem@hachyderm.io replied but it didn't make it over to Lemmy.

    @poVoq @fediverse there's also a proposal (from google) for IdP Initiated FedCM, instead of relying party initiated

    source