5 ms·

I'm excited about this - tried the demo, how do I know the site is not stealing my password? Shouldn't this use OAuth to solve that issue?

• imwillofficial 6y ago
  Because you don’t login via the site, you have to go through Matrix’ login flow, just like with any client.
  • southerntofu 6y ago
    Then why does the popup on Cactus ask for the password? If the matrix homeserver is responsible for the authentication, then cactus should probably only ask for a matrix identifier (user:server).
    • imwillofficial 6y ago
      On a second look, I agree.
• carlbordum 6y ago
  You don't, you have to trust it just like any other Matrix client. Hopefully there will be OAuth or something similar in the Matrix spec in the future, so you can use less trusted clients. If you want to comment with your user, but don't trust the client, you can use any Matrix client with Cactus Comments by clicking "Use a Matrix client" :-)