5 ms·

rel="me" for authentication sounds like it could help with the inevitable problem of Mastodon account verification. Instead of putting a verified checkmark on y

by geofft 8y ago

rel="me" for authentication sounds like it could help with the inevitable problem of Mastodon account verification. Instead of putting a verified checkmark on your name, whatever that is supposed to mean, put one on your home page if there's a rel="me" pointing back to the same profile. Parties that don't fully trust you (other federated servers, most likely, but individual clients if necessary) can verify the relationship before displaying the check mark.

CM30 8y ago
This is similar to my own idea for how to authenticate a Twitter verification esque setup; having the user upload auto generated files to their server and the site check for those, like how Google verifies accounts in Webmaster Tools. The issue however is that I suspect verification should also have the purpose of verifying that the individual/group doesn't just own a third party domain/resource, but that they're the owners of the version people associate with that name. All these systems make it very easy to just register say 'Microsofte' and end up with a verified account called 'Microsoft' or what not. That's going to allow for a lot of easy impersonation.
floatboth 8y ago
IIRC, App.net did exactly that — rel=me based verified checkmarks for the "personal site" field
- dfee 8y ago
  I tried finding a post-mortem on App.net but couldn’t. What exactly happened with them?
  - mikepurvis 8y ago
    Couldn't generate enough revenue on paid subscriptions to be sustainable. https://en.wikipedia.org/wiki/App.net#History https://en.wikipedia.org/wiki/App.net#History
epeus 8y ago
Mastodon now publishes rel=me on profile links, so you can do bidirectional verification between mastodon and other rel=me publishers like github and wordpress, as well as your own site. https://xoxo.zone/@KevinMarks/100616472097157585 https://xoxo.zone/@KevinMarks/100616472097157585
- epeus 8y ago
  more discussion of this in a fediverse context: https://pleroma.site/notice/3922993 https://pleroma.site/notice/3922993

by geofft 8y ago

CM30 8y ago

This is similar to my own idea for how to authenticate a Twitter verification esque setup; having the user upload auto generated files to their server and the site check for those, like how Google verifies accounts in Webmaster Tools. The issue however is that I suspect verification should also have the purpose of verifying that the individual/group doesn't just own a third party domain/resource, but that they're the owners of the version people associate with that name. All these systems make it very easy to just register say 'Microsofte' and end up with a verified account called 'Microsoft' or what not. That's going to allow for a lot of easy impersonation.

floatboth 8y ago

IIRC, App.net did exactly that — rel=me based verified checkmarks for the "personal site" field

dfee 8y ago
I tried finding a post-mortem on App.net but couldn’t. What exactly happened with them?
- mikepurvis 8y ago
  Couldn't generate enough revenue on paid subscriptions to be sustainable. https://en.wikipedia.org/wiki/App.net#History https://en.wikipedia.org/wiki/App.net#History

epeus 8y ago

Mastodon now publishes rel=me on profile links, so you can do bidirectional verification between mastodon and other rel=me publishers like github and wordpress, as well as your own site. https://xoxo.zone/@KevinMarks/100616472097157585 https://xoxo.zone/@KevinMarks/100616472097157585

epeus 8y ago
more discussion of this in a fediverse context: https://pleroma.site/notice/3922993 https://pleroma.site/notice/3922993