Pixelfed's announcement post

This is gonna be limited to the official app, right? In that case, I use Pixelix, so hoping that doesn't get infected with Google proprietary blob slop.

For your and everyone else's information, in case you or they don't know, that's not how it works.

Single sign on goes:

1. you ask [website] to login, the [website] sends you to google.
2. You log into google and give access.
3. google sends you back to [website], with the authentication that you're [specific google user]. And now you're logged in.

The whole thing requires extremely regular and normal https requests. There is no need for any proprietary blob. The thing that shows up on the website is often a picture that acts as a link. Companies offering single sign on usually ask websites who want to use it, to use specifically prepared images for branding and for users to recognize and go "I have used [company] single sign on before, I can use this safely!"

The only downside to single sign on is that [google] knows that you, [google user] are using [website].

Idea of not distributing registrations is dumb. Sounds like they didn’t even tried to find something better. This defeats purpose of federation. Everyone will land on one instance because hashtags don’t federate and people will start moving to big instances.

We don’t need corpo sso. We need federated auth providers and org which can fund instances which want to be on “trusted list”

Your final sentence is an issue as big as any imagined binary blob yet you present it as no big deal.

The problem with the web has been centralization. SSO is centralization.

SSO doesn't need to be centralized, at least not like how Google is centralized.

Guy at Google.... Yes officer, let's take a look at Robert O's whereabouts on the night when it all happened. Ah yes, here we see him login in the the usual por sites, pifed, and AliExpress. Yeah, he's a good guy, he didn't do it.

Wasn't that the idea behind OpenID?

The problem with the web has been centralization. SSO is centralization.

Yes, but the reason people still use SSO is that security is hard. If a website uses SSO, they don't need to store any password information. Reuse of tech and keeping the number of sources that have sensitive data small, are good.

Your final sentence is an issue as big as any imagined binary blob yet you present it as no big deal.

Priorities and orders of magnitude. If we can get people to quit instagram and to join pixelfed, I think that's a relative improvement, even if the google SSO is still not ideal. You are right, SSO with google is not ideal.

Pixelfed instance I've chosen went down for like a week already. Dark side of decentralised web 😑

It’s possible with OpenID. All you need is extract domain from login id and get provider configuration at https:///.well-known/openid-configuration. Problem is that if it’s down you can’t login into same account using another provider.

Technically same way as google or apple SSO works just fixed list of domains. Another problem with using whatever domain user supplied is that some domains are more trusted than others, or rather owners. I don’t mean from privacy perspective I mean stability and security. It’s much easier to hijack domain of small server which struggles to pay for domain name consistently than google.

If Fediverse want to use OpenID for login someone have to vet trusted auth providers.

Otherwise we need someway to federate user logins. Maybe literally have replicated users credentials across instances. Then all federed instances can authenticate users from any federed instance.

I think it's also just an optional sign-on method - I don't think you have to use it. It sounds like you can register and select servers etc in the normal way, and this is just an extra option for people who... like to do it that way?

The thing I don't like at this approach is that this is restricted to only pixelfed.social. Was Piefed doing the exact same thing? I remember Kbin and now Mbin allows for every instance to use their desired SSO.

But it only happens if you choose it.

Letting a random instance authenticate a random person as me is a terrible idea.

Can you explain why exactly? Particular scenario would be helpful to understand your POV

Because you can't count on every instance playing by the rules. If anyone can set up an instance and authenticate any federated account, then they could also choose to impersonate me.

I won’t pretend I looked into authentication algorithm of every fedi apps but I doubt it’s “trust me bro” algorithm. Otherwise what would prevent malicious instance to post from your name today. Even if it’s some wacky algorithm it’s not a rocket science to enhance it. Message signing and public key sharing is one of common ways to solve this kind of problems. The only reason I see not to do it is lack of will or resources, or both

SSO can be decentralized, no one is doing it tho

Yuck

"Oh it's fine, I will just make my own instance, and it will be up forever."

The only reason signatures work is because only your home instance can post as you. If you're saying you want any instance to be able to authenticate any user, even if all the rest of the fediverse is down, then you're eliminating that trust anchor (i.e., your home instance).

Currently, a malicious instance could pretend to post as any of ITS users, but NOT external users. The problem is if that instance is able to authenticate someone from a different instance, an you're suggesting. Then, they could post as that user and propagate that action through federation.

The only way this could work is if YOU as the user had a public/private key your on YOUR device(s). Then, any action made on your behalf could first be required to be signed LOCALLY on YOUR device.

Problems with that approach are:

• Key management: Using the fediverse on multiple devices
• Trust: Where do I "register" my public keys? Again, you need some trusted third party/parties, which defeats your idea of absolute decentralization. Who decides which key store instances are to be trusted? How does the registration work? For example, what if you have two such public key stores (decentralization much) that either don't federated together or they take some time to do so. What if the users register their own distinct public keys for the same username but in the two different public key stores? Trying to solve that requires either a fully centralized node or going into the dangerous territory of crypto bros (blockchains, i.e., some form of "majority" vote on which of the users is "allowed" to live on on).

Now I'm wondering if it'd be feasible to extend OpenWebAuth magic sign-on (developed by the Friendica and Hubzilla creator Mike Macgirvin in the Friendica fork-fork-forks Osada and Zap in 2018; now available on Hubzilla, (streams) and Forte client-side and server-side and on Friendica only client-side) to something that works similarly.

• I log into hub.netzgemeinde.eu, and I choose @jupiter_rowland@hub.netzgemeinde.eu as my active channel (the latter is something Hubzilla-specific).
• I go to sh.itjust.works.
• sh.itjust.works recognises me as being logged in as @jupiter_rowland@hub.netzgemeinde.eu and e.g. grants me some particular permissions.

Maybe this could be extended to:

• sh.itjust.works knows that @jupiter_rowland@hub.netzgemeinde.eu = @JupiterRowland@sh.itjust.works, automatically logs me in as @JupiterRowland@sh.itjust.works and gives me full local user permissions (as opposed to only guest permissions which are what OpenWebAuth is there for right now).

To explain why the comment below is correct, you are right that the other instance couldn't get your password. They don't need that to create a post/comment that is supposedly sent from an account though. Those aren't cryptographically signed or anything like that. It just says "this user sent this message".

I don't even think there is a way you could do this with some kind of cryptographic signature, unless it basically just sends an encrypted message to the home server and it verifies it, which then we have the same issue we started with of relying on a single server. I guess every message could be sent with a key, which can be disputed later. If the home server is unavailable, the message is sent, but it can later say that it's a forgery when it comes back online. It's not a perfect fix, but it's the only way this could even possibly work I think.

> Instance gets abandoned 3 months later

Tbf maybe I will make my own instance eventually. Losing my piefed acc doesn't hurt me cause it's not like my shitposts have any value. Losing carefully selected photos actually do feel bad. And if using someone else's node leads to that, maybe I should take the matter in my own hands (and lose my photos cause of my own mistake, hehe)

start rant/

Ah yes, dansup, aka the Fediverse superstar who cranks out such hits as "VAGUE FEATURE is Coming Soon", and "The rarely updated official app for Pixelfed/Loops is going to get updated soon!". Both of those are from the album" I insist on gatekeeping outside developers from contributing".

I've interacted with him as a fellow developer of the same stack he uses, and I have always appreciated where his heart is at regarding the fedi. But, the track record of quality work suffers from chasing shiny objects, and absolute spaghetti code.

Also, I'm going to be blunt in saying this; he apes existing ideas (insta, TikTok), gives them a quasi corpo social platform facade with the goal to be welcoming to the refugees who jump the fences.

This SSO thing is the antithesis of decentralization and the spirit of digital sovereignty. Literally handing Google more user data for the sake of fedi adoption via SSO is mind boggling. How many people here left big tech because of the blatant surveillance state that's been built?

I keep trying to support his work, but I'm killing my Pixelfed and Loops accounts.

/rant

User registers at home server. Client generates pair of public and private keys, password provided by user during registration is used to encrypt (symmetrically) private key. Public and encrypted private keys stored on home server and then propagate over federation to other servers. Obviously propagation takes some time. Just like anything that uses ActivityPub (don’t know why I have to say it explicitly). Original private key not recorded anywhere. User initiates login on federated server. Federated server challenges user by providing encrypted private key and challenge phrase. User uses password to decrypt private key on client side and signs message with challenge phrase. Server uses public key to validate signature and phrase. User logged in. User creates signed post. All federated servers have copy of public key so they can check authenticity of origin of post.

I’m not saying it’s easy or perfect. I have no idea how feasible it is in current architecture. Probably there’s a smarter and more secure way to do it. I’m also not a team of security engineers who is getting paid to get this kind of things designed professionally.

My point is that, I think, it’s more of willingness issue than technical.

Also, I’m going to be blunt in saying this; he apes existing ideas (insta, TikTok), gives them a quasi corpo social platform facade with the goal to be welcoming to the refugees who jump the fences.

But this is what people want. Not alternatives that are different because they're better. Not alternatives that are better because they're different, because they intentionally don't ape a corporate silo. No, what they want is all-out, 1:1 clones of corporate silos in the Fediverse so they don't have to get used to something new.

One reason why Bluesky is so successful is because it's a clone of 2012 Twitter, both the Web interface and the official app.

I've read people reject Friendica as a Facebook alternative because it's look and feel is so different from Facebook's. Because they expected a full-on Facebook clone, and Friendica isn't one.

I dare say that a lot fewer people would have escaped from Reddit to Lemmy if Lemmy wasn't so bloody close to Reddit in UI and UX.