5 ms·

this is a valid concern and we have discussed this with Matrix community members and developers the problem is, Matrix has it's own login system, that does not

this is a valid concern and we have discussed this with Matrix community members and developers the problem is, Matrix has it's own login system, that does not support OAuth or offer any trust-less methods, such as login requests via a bot (how it's done in Telegram) currently this is how all clients implement login to Matrix, be it Cactus comments or the beautiful Cinny client

vbezhenar 5y ago
What's wrong with sending login token via Matrix and asking user to copy it into login form (or just sending auth link)?
- ushakov 5y ago
  i'm all for it and considering adding more ways to login this project is less than a week old at the time, so only password-based method is implemented
- heftig 5y ago
  Handling login-via-Matrix like email or SMS sounds like the right approach.
jstanley 5y ago
So in this system is your software handling the username/password, or is the form provided by the Matrix server? Since the form asks for your homeserver, it seems like I'd be typing my password into a form controlled by you, which seems like a bad thing to train people to do? EDIT: Also, "requires no backend to function" - but if I want to use this to give users access to their data in my backend, how can I do that securely? Do I get some sort of token from their Matrix homeserver that my backend can use to ensure that the client is authenticated as the user they claim to be? Or do I need to pass the username and password to my backend so that my backend can authenticate them with their homeserver? Don't get me wrong: I love the idea and it's a cool project & great proof-of-concept. I think the current implementation is not secure enough for me to trust. It's possible that I'm mistaken and it actually is secure! But in that case I'd want to see some substantiated argument in the README, explaining how it works & why it's trustworthy.
- ushakov 5y ago
  yes, the form sends a POST request to your matrix server matrix indeed does have it's own login UI, which you can embed in other applications (but it is quirky)
- ushakov 5y ago
  > Do I get some sort of token from their Matrix homeserver correct after you sign in, you will get a token, which you can then use to authenticate against matrix home server
- heftig 5y ago
  The website does get your credentials. To be fair, this is how password login with any of the web clients works as well. Which makes it hazardous to use clients not hosted by the homeserver or a trusted third party. However, if the homeserver is using OIDC, the user credentials are handled entirely by the external OIDC provider and the client doesn't get them. But then you should be using OIDC directly and not "Sign in with Matrix."
  - driminicus 5y ago
    We are actually working on fixing the password sending issue, see for instance https://github.com/matrix-org/matrix-doc/pull/3262 https://github.com/matrix-org/matrix-doc/pull/3262 Of course, untrusted clients can do all kinds of evil things after having authenticated. (And also clients still need the plaintext password at least client-side no matter what we do)
    - detaro 5y ago
      > (And also clients still need the plaintext password at least client-side no matter what we do) Are matrix devs seriously not aware of what OAuth is and does? That is ... concerning.
      - driminicus 5y ago
        Matrix does actually support OAuth (in fact, the mozilla.org matrix server can only be logged in to through OAuth)
dxld 5y ago
Crazy idea: what if you use a random room ID as an OTP and recognize the user as signed-in as soon as they join that room via an invite or matrix.to link? I'm not sure if this fits within your constraints since it would need a backend but I think it'd be pretty neat :)
- ushakov 5y ago
  i was considering somewhat similar approach, where if the user accepts a room invite i would authenticate them but this doesn’t work, because there is only one standard method of authentication, which is by sending username/password
  - deleted 5y ago
    [deleted]
  - 3np 5y ago
    ...Why? A matrix bot could send the user a short-lived token they can paste to the site to authenticate. Optional QR for mobile. No need for homeserver changes, changing protocols or touching any user credentials. Since you’d rely on an existing matrix session, the bot could send the token e2ee, meaning after TOFU you could even protect against malicious homeserver operators. You could also do the inverse, having the user send the token to the bot.
    - ushakov 5y ago
      this is neat and i have thought of that but it does not authenticate you against the homeserver and does not grant you the access token, meaning the application would not be able to access Matrix APIs on user's behalf
      - 3np 5y ago
        Why does a federated sign-in solution for a third-party web app need to authenticate to the homeserver or access Matrix APIs on the users behalf?! That’s exactly what you want to avoid. The bot can still get things shared by the user like username, avatar, 3pids and pubkeys. Can you give me a use-case that my proposed solution is insufficient for due to inability to impersonate the user to the Matrix homeserver?
jamietanna 5y ago
Thanks for the info! Do you know if anyone's investigated OAuth2 or in particular IndieAuth (https://indieauth.spec.indieweb.org https://indieauth.spec.indieweb.org) which is an Open Web extension to OAuth2 which would remove the need for client registration, and still allow OAuth2 interactions to remove need for the credentials being shared?
- ushakov 5y ago
  There is open-issue here: https://github.com/matrix-org/matrix-doc/issues/2615 https://github.com/matrix-org/matrix-doc/issues/2615 and custom implementation: https://github.com/turt2live/matrix-oauth https://github.com/turt2live/matrix-oauth

vbezhenar 5y ago

What's wrong with sending login token via Matrix and asking user to copy it into login form (or just sending auth link)?

ushakov 5y ago
i'm all for it and considering adding more ways to login this project is less than a week old at the time, so only password-based method is implemented
heftig 5y ago
Handling login-via-Matrix like email or SMS sounds like the right approach.

jstanley 5y ago

So in this system is your software handling the username/password, or is the form provided by the Matrix server? Since the form asks for your homeserver, it seems like I'd be typing my password into a form controlled by you, which seems like a bad thing to train people to do? EDIT: Also, "requires no backend to function" - but if I want to use this to give users access to their data in my backend, how can I do that securely? Do I get some sort of token from their Matrix homeserver that my backend can use to ensure that the client is authenticated as the user they claim to be? Or do I need to pass the username and password to my backend so that my backend can authenticate them with their homeserver? Don't get me wrong: I love the idea and it's a cool project & great proof-of-concept. I think the current implementation is not secure enough for me to trust. It's possible that I'm mistaken and it actually is secure! But in that case I'd want to see some substantiated argument in the README, explaining how it works & why it's trustworthy.

ushakov 5y ago
yes, the form sends a POST request to your matrix server matrix indeed does have it's own login UI, which you can embed in other applications (but it is quirky)
ushakov 5y ago
> Do I get some sort of token from their Matrix homeserver correct after you sign in, you will get a token, which you can then use to authenticate against matrix home server
heftig 5y ago
The website does get your credentials. To be fair, this is how password login with any of the web clients works as well. Which makes it hazardous to use clients not hosted by the homeserver or a trusted third party. However, if the homeserver is using OIDC, the user credentials are handled entirely by the external OIDC provider and the client doesn't get them. But then you should be using OIDC directly and not "Sign in with Matrix."
- driminicus 5y ago
  We are actually working on fixing the password sending issue, see for instance https://github.com/matrix-org/matrix-doc/pull/3262 https://github.com/matrix-org/matrix-doc/pull/3262 Of course, untrusted clients can do all kinds of evil things after having authenticated. (And also clients still need the plaintext password at least client-side no matter what we do)
  - detaro 5y ago
    > (And also clients still need the plaintext password at least client-side no matter what we do) Are matrix devs seriously not aware of what OAuth is and does? That is ... concerning.
    - driminicus 5y ago
      Matrix does actually support OAuth (in fact, the mozilla.org matrix server can only be logged in to through OAuth)

dxld 5y ago

Crazy idea: what if you use a random room ID as an OTP and recognize the user as signed-in as soon as they join that room via an invite or matrix.to link? I'm not sure if this fits within your constraints since it would need a backend but I think it'd be pretty neat :)

ushakov 5y ago
i was considering somewhat similar approach, where if the user accepts a room invite i would authenticate them but this doesn’t work, because there is only one standard method of authentication, which is by sending username/password
- deleted 5y ago
  [deleted]
- 3np 5y ago
  ...Why? A matrix bot could send the user a short-lived token they can paste to the site to authenticate. Optional QR for mobile. No need for homeserver changes, changing protocols or touching any user credentials. Since you’d rely on an existing matrix session, the bot could send the token e2ee, meaning after TOFU you could even protect against malicious homeserver operators. You could also do the inverse, having the user send the token to the bot.
  - ushakov 5y ago
    this is neat and i have thought of that but it does not authenticate you against the homeserver and does not grant you the access token, meaning the application would not be able to access Matrix APIs on user's behalf
    - 3np 5y ago
      Why does a federated sign-in solution for a third-party web app need to authenticate to the homeserver or access Matrix APIs on the users behalf?! That’s exactly what you want to avoid. The bot can still get things shared by the user like username, avatar, 3pids and pubkeys. Can you give me a use-case that my proposed solution is insufficient for due to inability to impersonate the user to the Matrix homeserver?

jamietanna 5y ago

Thanks for the info! Do you know if anyone's investigated OAuth2 or in particular IndieAuth (https://indieauth.spec.indieweb.org https://indieauth.spec.indieweb.org) which is an Open Web extension to OAuth2 which would remove the need for client registration, and still allow OAuth2 interactions to remove need for the credentials being shared?

ushakov 5y ago
There is open-issue here: https://github.com/matrix-org/matrix-doc/issues/2615 https://github.com/matrix-org/matrix-doc/issues/2615 and custom implementation: https://github.com/turt2live/matrix-oauth https://github.com/turt2live/matrix-oauth