4 ms·
Still, keys and sessions should all be managable from the client and not depend on a separate server/browser flow, no? What I'm talking about so far is basical
by baobun 1y ago
Still, keys and sessions should all be managable from the client and not depend on a separate server/browser flow, no?
What I'm talking about so far is basically orthogonal to user-server authn/authz flows and mechanics (the scopes of MAS and OIDC). Tightly coupling user-user authn to client-server authz doesn't seem ideal.
- Arathorn 1y agouser-user authn is indeed orthogonal to client-server authz. For authenticating your own devices in EX, you are forced to verify them at login. If you have other devices flying around that aren’t verified then you have to use a different app to unpick the mess - in a Matrix 2.0 world it should not be possible to get into that mess (even if the server DB rolls back). So it’s only if you have 1.x clients hanging around that you need this… at which point you might as well use the 1.x clients to unpick the mess if needed. For verifying other users - EX should support that well as the classic apps ever did.