3 ms·

This all assumes that things are always consistent, free of bugs and clears throat database issues (yeah we got hit by that too - I don't see how we'd been able

by baobun 1y ago

This all assumes that things are always consistent, free of bugs and clears throat database issues (yeah we got hit by that too - I don't see how we'd been able to troubleshoot and salvage it as well as we managed if we had been on EX only - MAS or not).... The problematic situations that have otherwise crept up are generally devices that all think they're independently verified but somehow get out of sync for any nuber of arcane or archaic reasons. Reset flows are another pain point. And yeah, I think our homeserver will not adopt MAS/OIDC - requiring a separate service and client (web browser) for account managament certainly feels like a regression. I see why it makes sense for matrix.org and the customers of Element but making EX depend on MAS for full functionality was not something I expected going in.

Arathorn 1y ago
I suspect we'll end up bundling MAS inside Synapse for situations like this - trying to limp along on the legacy auth stack when stuff like 2FA/MFA/QR-login etc are all handled by MAS/OIDC will be painful.
- baobun 1y ago
  Still, keys and sessions should all be managable from the client and not depend on a separate server/browser flow, no? What I'm talking about so far is basically orthogonal to user-server authn/authz flows and mechanics (the scopes of MAS and OIDC). Tightly coupling user-user authn to client-server authz doesn't seem ideal.
  - Arathorn 1y ago
    user-user authn is indeed orthogonal to client-server authz. For authenticating your own devices in EX, you are forced to verify them at login. If you have other devices flying around that aren’t verified then you have to use a different app to unpick the mess - in a Matrix 2.0 world it should not be possible to get into that mess (even if the server DB rolls back). So it’s only if you have 1.x clients hanging around that you need this… at which point you might as well use the 1.x clients to unpick the mess if needed. For verifying other users - EX should support that well as the classic apps ever did.

by baobun 1y ago

Arathorn 1y ago

I suspect we'll end up bundling MAS inside Synapse for situations like this - trying to limp along on the legacy auth stack when stuff like 2FA/MFA/QR-login etc are all handled by MAS/OIDC will be painful.

baobun 1y ago
Still, keys and sessions should all be managable from the client and not depend on a separate server/browser flow, no? What I'm talking about so far is basically orthogonal to user-server authn/authz flows and mechanics (the scopes of MAS and OIDC). Tightly coupling user-user authn to client-server authz doesn't seem ideal.
- Arathorn 1y ago
  user-user authn is indeed orthogonal to client-server authz. For authenticating your own devices in EX, you are forced to verify them at login. If you have other devices flying around that aren’t verified then you have to use a different app to unpick the mess - in a Matrix 2.0 world it should not be possible to get into that mess (even if the server DB rolls back). So it’s only if you have 1.x clients hanging around that you need this… at which point you might as well use the 1.x clients to unpick the mess if needed. For verifying other users - EX should support that well as the classic apps ever did.