4 ms·

What's frustrating is that single sign-on and federated identity is a well, well solved problem, yet we barely use it. Outside of B2B setups, the best we get is

What's frustrating is that single sign-on and federated identity is a well, well solved problem, yet we barely use it. Outside of B2B setups, the best we get is "sign in with {Google,Facebook,Apple}". No thanks. And the even more frustrating part is knowing that those logins are implemented with OAuth or OpenID, yet arbitrarily limited to a few megacorps

paulmd 3y ago
yeah people arbitrarily throw content federation and identity federation into the same bin. you can get a lot of the squeeze of a centralized reddit-style service (in terms of low-friction user signup) without needing actual content federation. One ID can still let you post on multiple boards without needing to sign up in 27 places, and that doesn't need content federation. It also significantly reduces the moderation problem because now you are letting {Google,Facebook,Apple} solve (or at least gate/significantly reduce) the spammers problem for you. That said, custom IDPs are inherently at odds with this value in spam filtering. If a spammer just needs to set up a custom domain, you don't get any signal as to user quality.
- didntcheck 3y ago
  Yeah this is how I feel about Lemmy. The only federation I care about is being able to use one account to post on many subreddit-equivalents, but beyond that the only link between communities on Reddit was plain old hyperlinks. No need for the backends to talk to each other at all. Assembling the feeds from all subs into a single timeline should be something the client does
dcow 3y ago
I also pine for a world where I can put in my own IDP url and login anywhere. But you have to admit that the UX of such a flow is hard to solve for the general user which is why we have crummy “log in with X” buttons.
- detourdog 3y ago
  I got a standalone access controller for my building that uses LDAP for accounts. I have it pointed a 10.6.8 server that resolves to id.cogs.com on my internal network. Long ago I had an OD server acting as the backed for OpenID and all of that pointed to id.cogs.com. I'm trying to recreate that set-up again now. Considering how long Apple has been rolling out Apple ID and they are only now at the point where they may trust the users with their own key-server I think demonstrates that. When it works it's magic and when broken might as well give up. A backup can always save you depending on the timestamp.
detourdog 3y ago
I think Apple is about to open up Passkey management to device owner. This will essentially turn every Apple device kerberos type key manager. This will open up federation with a new level of authentication. The only hitch is that one has to trust Apple as the key manager. Everyone that can get past that hurdle will be able to manage very sophisticated trust relationships.

paulmd 3y ago

yeah people arbitrarily throw content federation and identity federation into the same bin. you can get a lot of the squeeze of a centralized reddit-style service (in terms of low-friction user signup) without needing actual content federation. One ID can still let you post on multiple boards without needing to sign up in 27 places, and that doesn't need content federation. It also significantly reduces the moderation problem because now you are letting {Google,Facebook,Apple} solve (or at least gate/significantly reduce) the spammers problem for you. That said, custom IDPs are inherently at odds with this value in spam filtering. If a spammer just needs to set up a custom domain, you don't get any signal as to user quality.

didntcheck 3y ago
Yeah this is how I feel about Lemmy. The only federation I care about is being able to use one account to post on many subreddit-equivalents, but beyond that the only link between communities on Reddit was plain old hyperlinks. No need for the backends to talk to each other at all. Assembling the feeds from all subs into a single timeline should be something the client does

dcow 3y ago

I also pine for a world where I can put in my own IDP url and login anywhere. But you have to admit that the UX of such a flow is hard to solve for the general user which is why we have crummy “log in with X” buttons.

detourdog 3y ago
I got a standalone access controller for my building that uses LDAP for accounts. I have it pointed a 10.6.8 server that resolves to id.cogs.com on my internal network. Long ago I had an OD server acting as the backed for OpenID and all of that pointed to id.cogs.com. I'm trying to recreate that set-up again now. Considering how long Apple has been rolling out Apple ID and they are only now at the point where they may trust the users with their own key-server I think demonstrates that. When it works it's magic and when broken might as well give up. A backup can always save you depending on the timestamp.

detourdog 3y ago

I think Apple is about to open up Passkey management to device owner. This will essentially turn every Apple device kerberos type key manager. This will open up federation with a new level of authentication. The only hitch is that one has to trust Apple as the key manager. Everyone that can get past that hurdle will be able to manage very sophisticated trust relationships.