4 ms·
For me, it is difficult to pin down what exactly this type of thing should be. Is it purely for data migration? ie: I am closing my facebook account and want t
by shuntress 6y ago
For me, it is difficult to pin down what exactly this type of thing should be.
Is it purely for data migration? ie: I am closing my facebook account and want to extract an archive copy of all my contacts, posts, uploads, etc
Is it better to function as a direct transfer? How could it possibly make sense to transfer my old hackernews comments to my new facebook account?
The more I think about it, the more I just come back to email. Not necessarily the specific implementations, just the high level design: From any domain, I should be able to send a direct message to a contact in any domain. They should be able to view any basic[0] content I post (text, images, calendar) and respond in kind with basic content regardless of the domain either of us use.
I'm not sure that fully-federated-everything is the best answer and I would expect most reasonable implementations to include "Sign in at facebook.com for the best experience" or whatever.
I can't personally imagine the ideal system yet but I assume it must be somewhere in the unmapped middle ground between Facebook/Twitter/Apple silos and thousands of impossible-to-trust sloppily-federated micro-domains hosted by random individuals.
Edit: As an aside, the issue of authentication seems critically important with no clear designs that would provide a secure and usable solution. Though, the issue of account name squatters does already exist, it is relatively manageable with so few domains and no inter-operability between domains.
[0] This concept of "basic" data seems to be more-or-less captured by the "verticals" described here https://datatransferproject.dev/documentation https://datatransferproject.dev/documentation
- 3np 6y agoOn authentication - or rather, authorization, it's usually not relevant to establish identity ass opposed to access rights - I strongly feel this should build upon cryptographic decentralized identifiers - on registration, send the service a signed number of your choice. You can now sign in on future visits by signing messages with the same key. No e-mail or phone number needed (but can still be requested by the service, of course). We're kind of seeing this by a second-order effect in the Ethereum dapp space, where you need this functionality to interact with the blockchain etc. Every user has some form ow Web3-compatible software, most commonly Metemask browser extension. I think it's an interesting ground where this could start spreading - the key infrastructure etc are already in place! (And in case anyone gets confused, it can be used perfectly fine without actually transacting to any blockchain or holding any cryptocurrency - it's just normal elliptic curve keys with easy-to-use APIs)
- shuntress 6y agoYou can talk about authorization alone but only because authentication is necessary to handle authorization and so can be assumed. send the service a signed number of your choice. You can now sign in on future visits by signing messages with the same key This part is the authentication. My extreme opinion is that the post office should run OAuth servers.