4 ms·

Speaking as project lead for Matrix, while we're always happy to see new projects building on Matrix, we share the concern that users shouldn't be encouraged to

Speaking as project lead for Matrix, while we're always happy to see new projects building on Matrix, we share the concern that users shouldn't be encouraged to enter their Matrix username & password into arbitrary webapps which may or may not be trusted. To be clear: Sign in with Matrix is an independent project from a community member which isn't associated or endorsed by the Matrix core team. The direction we're headed in the Matrix spec core team is instead towards replacing Matrix's current auth mechanisms with normal Open ID Connect (rather than wrapping our own OIDC-like thing, as we do today) - as per https://github.com/sandhose/matrix-doc/blob/msc/sandhose/oauth2-profile/proposals/2964-oauth2-profile.md https://github.com/sandhose/matrix-doc/blob/msc/sandhose/oau.... The common login flow would then be for users to be authed by their server using a trusted OIDC identity provider, rather than ever trusting arbitrary clients with their credentials. This is not finalised yet, as we still want to find ways to support folks authing on known trusted clients without having to embed a web browser - and we don't want to design out cryptographic login (e.g. OPAQUE style auth mechanisms) in future.

ushakov 5y ago
glad to see you here and agree to all the things said btw. if you want to build a proper widget like that in the future, i’d be happy to help! (@mishushakov:matrix.org)
redsolver 5y ago
Maybe you are interested in this little PoC I made a while ago which instead sends a one-time-auth code using Matrix: https://loginwithmatrix.tiktalk.space/ https://loginwithmatrix.tiktalk.space/
- remram 5y ago
  Just tried it and never got a code. Is the source available for this?
  - redsolver 5y ago
    The implementation is very simple, it just uses the Matrix SDK to create a direct chat and send a message.
  - ptman 5y ago
    See https://matrix-login.lyc.fi https://matrix-login.lyc.fi , comes with source
- ushakov 5y ago
  this does not authenticate me on the homeserver and does not grant a token nice concept, but useless for applications
  - redsolver 5y ago
    It does prove that you own the specific matrix id you are logging in with to the website. It can for example be used as an alternative everywhere where "Sign in with Google" is used, so I don't understand why it should be useless for applications.
    - ushakov 5y ago
      "Sign in with Google" also grants you access token you can use to access Google APIs on behalf of the user sorry, but your concept doesn't
      - MakiXx 5y ago
        Aren't you supposed to use "Sign in with Google" or which ever service to prove to the app that you own your unique id (e.g. email)? If you want Google APIs, then that's a completely different scope here.
- LogonType10 5y ago
  On a similar note, check out this PoC I found that steals Matrix credentials: https://github.com/mishushakov/signin-with-matrix https://github.com/mishushakov/signin-with-matrix

ushakov 5y ago

glad to see you here and agree to all the things said btw. if you want to build a proper widget like that in the future, i’d be happy to help! (@mishushakov:matrix.org)

redsolver 5y ago

Maybe you are interested in this little PoC I made a while ago which instead sends a one-time-auth code using Matrix: https://loginwithmatrix.tiktalk.space/ https://loginwithmatrix.tiktalk.space/

remram 5y ago
Just tried it and never got a code. Is the source available for this?
- redsolver 5y ago
  The implementation is very simple, it just uses the Matrix SDK to create a direct chat and send a message.
- ptman 5y ago
  See https://matrix-login.lyc.fi https://matrix-login.lyc.fi , comes with source
ushakov 5y ago
this does not authenticate me on the homeserver and does not grant a token nice concept, but useless for applications
- redsolver 5y ago
  It does prove that you own the specific matrix id you are logging in with to the website. It can for example be used as an alternative everywhere where "Sign in with Google" is used, so I don't understand why it should be useless for applications.
  - ushakov 5y ago
    "Sign in with Google" also grants you access token you can use to access Google APIs on behalf of the user sorry, but your concept doesn't
    - MakiXx 5y ago
      Aren't you supposed to use "Sign in with Google" or which ever service to prove to the app that you own your unique id (e.g. email)? If you want Google APIs, then that's a completely different scope here.
LogonType10 5y ago
On a similar note, check out this PoC I found that steals Matrix credentials: https://github.com/mishushakov/signin-with-matrix https://github.com/mishushakov/signin-with-matrix