Nearly anything can be made to work, but in many cases it means jumping through a lot of hoops to get there. Without a trusted party you have to be much more s

Nearly anything can be made to work, but in many cases it means jumping through a lot of hoops to get there. Without a trusted party you have to be much more suspicious of everything coming in, as you say, and that means coding additional verification, everywhere. For instance, with that model of friend requesting, there has to be some method of proving that A made the request to B. I can think of various ways of doing this (A signs their request, or A adds a duplicate outgoing request to a queue only they can write to, etc), but the point is that they're all much more overheard than doing it the traditional way. And that's just for a friend request. The big concern is that all this overheard will mount up enough to offset any of the other gains Firebase brings.