2 ms·
I suspect we'll end up bundling MAS inside Synapse for situations like this - trying to limp along on the legacy auth stack when stuff like 2FA/MFA/QR-login etc
by Arathorn 1y ago
I suspect we'll end up bundling MAS inside Synapse for situations like this - trying to limp along on the legacy auth stack when stuff like 2FA/MFA/QR-login etc are all handled by MAS/OIDC will be painful.
- baobun 1y agoStill, keys and sessions should all be managable from the client and not depend on a separate server/browser flow, no? What I'm talking about so far is basically orthogonal to user-server authn/authz flows and mechanics (the scopes of MAS and OIDC). Tightly coupling user-user authn to client-server authz doesn't seem ideal.
- Arathorn 1y agouser-user authn is indeed orthogonal to client-server authz. For authenticating your own devices in EX, you are forced to verify them at login. If you have other devices flying around that aren’t verified then you have to use a different app to unpick the mess - in a Matrix 2.0 world it should not be possible to get into that mess (even if the server DB rolls back). So it’s only if you have 1.x clients hanging around that you need this… at which point you might as well use the 1.x clients to unpick the mess if needed. For verifying other users - EX should support that well as the classic apps ever did.