There’s a difference between a federated identify and single-sign on. Your identity /u/mango_master@lemmy.world IS federated. You don’t need to have a separate login for each instance. You can use that identity to interact with any instance much the same way I am using my federated identity to currently respond to you.
Should be @mango_master if all is working correctly, actually ;)
The threadiverse is a bit complicated since there needs to be a way of distinguishing between users and groups, but the @user@host.org format is standardized across the fediverse.
It’s funny because using the /u/ format seems to work just fine in the web interface, creating the proper link. Typing it out in the @ format doesn’t automatically create the hyperlink when I type it, but yours works just fine. ¯*(ツ)*/¯
If you post a link to this, then I click that link, I am unable to reply directly, since I am on lemmy.world. I would need to first track down the equivalent post in my instance to reply. SSO solves this
Oh I see. Yeah, there could be a feature (a browser addon would work too) that reads the webpage meta data before opening it, and pops a "Open in kbin/lemmy/whatever?" window.
That should just work. You view the post on your own instance and reply there. That reponse trickles to the other instances.
It may take a while to propagate though. The paradigm is close to that of the ancient nntp news groups where responses travel at the speed of the server's synchronisation. It may be tricky for rapid fire conversation, but works well for comments of articles.
Anybody who sees that link and is not already from someother.instan.ce now has to track down that post on their home instance in order to interact with it, which is a bad experience. It's not the absolute worst thing in the world, like the home URL for the discussion we're in right now is https://lemmy.world/post/1194109 and if you paste that URL into your local domain's search it should find you the relevant discussion locally, but it still kinda sucks. In theory this would be sort of solve-able on the server end by having it search for any instance links behind the scenes and re-write other people's links to point to the equivalent page on your own instance, but right now there's no "nice" way to handle that situation.
Agreed on your point. We need a way to identify those links so that our browser or app can automatically open them through our own instance.
I am thinking along the lines of a registered resource type, or maybe a central redirect page, hosted by each instance, that knows how to send you to your instance to view the post there.
I am sure it is a problem that can be solved. I would however not be in favour of some kind of central identity management. It is to easy a choke point and will take autonomy away from the instances.
Gotcha. As others have already mentioned it is obtuse. If you end up at the post via your own instance it works but if someone links directly to the canonical post then you get confronted with needing to login. e.g. I see this post as mylemmy.win/post/114914, so I can interact just fine whereas if someone sent me the link to lemmy.world/post/1194109 (same post, different entry point) I’m stuck.
I do not have the same experience. If I want to interact with a different instance then I have to login to that instance. Granted I'm very new to Lemmy but so far the apps are not quite there yet and exploring the fediverse is difficult. Searches are useless unless you know exactly what instance you need to find what you're looking for.
I understand. It really comes down to your entry point. For example, as long as I’m viewing the community/user/content via my instance I can interact; e.g. I’m replying to a post on mylemmy.win/post/114914 ; you, on the other hand are replying to kbin.social/…/why-can-t-we-have-federated-identit… . Since we’re viewing from our own instances we can interact. If either of us goes directly to the canonical URL, lemmy.world/post/1194109 , we’d be forced to login. It’s all the same post, just different points of entry that muddy the user experience.
I attended a talk in 2019 by Sir Tim Berners-Lee on Solid, which sort of seems related to what you are getting at. The idea being that you own your data/identity, and can decide to share it with third parties. It goes over things like files, but I believe login identities were also meant to be part of it, I see when I scroll down:
authenticated by a decentralized extension of OpenID Connect
I've been wondering recently, especially with Pixelfed adding login with Mastodon recently, if anyone has heard or experienced anything with that project. But considering I haven't seen it spoken about or implemented since then, I'm not sure I should be hopeful
The technical challenges are vast, is the long and short of it. But it’s high time there’s a good discussion over how it should (or might) work, at least the kinds of properties such a system should have.
Self hosting of federated credentials should be possible, but not required
’Backwards tracking’ of federated credentials should only be possible with limited requests (e.g. ‘verify author of post’) and approval of the credential owner
All data on the credentials instance should be properly encrypted
All data on credentials instance should be fully and easily portable to other instances via common protocols
There are several issues involved here, beyond just ‘mere’ technology, that need addressing. Personally I think a good start might be to engage with public libraries here. They already keep simple identity records (library cards) and have public service purpose well-aligned with the concepts of the federation and public distribution of information and knowledge.
That then introduces ease of use problems. You won’t be able to log in to another device without copying your key over from an already logged in device for example.
Web browsers don’t usually allow access to local files made outside the browser, so even logging in between browsers would require having your key on hand.
Not to mention if you lose the file containing your key (hard drive craps out, etc), you’ll lose access to your account entirely. So users would be forced to backup their keys.
Not issues that would make the product unusable, but enough of a hindrence that 90% of users would just go find something else (like threads) to use instead.
I can’t use my account on another device until I input my password, so either way I need to use a password manager. If you reuse the same password (so you can remember it for hundreds of sites instead of using a password manager), being forced into using a key instead would actually be an improvement for your security.
So after twenty-something years on social media, along with mailing lists, messageboards, usenet, this is a topic I think about literally every time I have to add, change, migrate, delete my account as I migrated from platform to platform like some virtual vagabond between text-driven city-states. A virtual vagabond with no worldly goods, no name, no history, and completely invisible to all. To exist, I must apply to the City Leader, and if accepted, I get a name, a nice studio apartment, and visibility as well as contact with other humans after watching a short commercial every five or so humans. If I leave, am thrown out, or the city is burned down, I can’t take anything the city gave me with me. By ‘gave’, I mean ‘loaned’ btw; none of those things were actually mine.
All the discussion of whether or not to federate with Threads were interesting in that in general, it’s kind of pointless. A server instance isn’t a democracy; the owner’s opinion is the only one that matters. If you don’t like it, leave. And I don’t argue their right to do so; they’re paying the bills, doing the upgrades, eating grapes with robot butlers, I don’t know their lives. Federated means anyone can run their own not-twitter or not-reddit; go for it. All you need is money, free time, and the knowledge of how to register a domain name, get, run, secure, and maintain servers, and install and configure the program, lure people in, and avoid breaking any national or international laws. Like I said: I really seriously do not argue the owner’s right to decide anything for their server. i know how to do all those things and I ran several websites and archives: I wanted a nap before installation step.
Fediverse is a massive step in loosening the stranglehold megacorporations had on our ability to shitpost in peace and talk about our cats without feeling stalked by people wanting to sell us shit or sell our browsing habits, blood pressure, and underwear size to those who will the try to sell us deeply individualized shit; it’s the circle of life, man.
Wow this got long but feelings.
So at this point–two decades and change of social media, the rise and fall of social empires, so much virtual vagabonding across the virtual desert to find a new city-state…I don’t think it’s too early to consider getting around to a productive discussion of how we go about separating the individual identity from the community and define what is theirs to keep no matter where they are. If there was ever a place and time to start building a model, it’s where all the city states are allies and the individuals can interact with each other no matter what city they’re in. The account transferability in Mastodon is a really good start, but it’s not a solution, much less the solution. It’s a beginning.
I don’t expect to have a working, finished, flawless product in six to eight weeks or six to eight months; I expect it to slide in three weeks and two days after the announcement that it’s ready for alpha testing and immediately break the first time a tester opens it; it’ll be another month before it goes into testing again. I expect it will be a weird buggy mess of wtf after months of virtual warfare and everyone will hate it before the rough draft of the design documents are even released. I expect there will be one weird guy who really thinks everything should be written in Rust because he’s insane and never sleeps. Five to eight devs will dramatically quit; one will quietly move to Utah and farm emus. None of them will be the Rust guy; you’re stuck with him. I expect the working version after testing is done will be hated by everyone and probably kind of crappy. But it will also be amazing, because as of it’s release–no matter how shitty, buggy, or how many inexplicable design choices are made–the individual exists outside of being community property and that no matter where we go or how much we pissed off that admin or if our city-state was nuked from orbit, there are things that are ours and we get to keep them.
As much as I disagree with him, like a LOT, I do think Nilay from the Verge has a point. It does feel like the “new” internet we have become used to over the years is starting to shift. It feels like people are becoming more and more fed up with social media and want to go back to just hanging out with virtual strangers online. Like, arguing on Twitter with people is all well and good, but it’s also miserable and stressful and it’s been getting worse. Not to mention Elon has no idea what he’s doing. Mark is pivoting away from Boomerbook and Instagram because one isn’t growing and the other is an amalgamation of every other feed based social network, and Reddit is burning down. At this point it was only a matter of time before Corporations set their sight on the Fediverse. Nothing else is working.
The problem with that is that big corporations have no idea why the Fediverse exists and think selling personal data and being free is enough to attract people. Hell, I didn’t even know what the Fediverse was until Reddit immolated itself so I don’t expect your average person to be aware of the inner workings either. That being said it doesn’t take long to realize that the Fediverse is something altogether different once you are a part of it.
There isn’t an algorithm pushing negativity to the top, and each instance is like a person inviting you into their house to stay if you want; as long as you don’t mess up the furniture you are good. At the end of the day you have been allowed in so you should be on your best behavior and follow the rules. You can argue all you want but you are not in control, and if you want control open your own house. Simple as. You can also stroll through the neighborhood if you want as long as a wall hasn’t been built around other houses.
I like this comment but in the end this is something most people won’t want, me included, because a decentralized identity would just mean an even better way to track and get yourself doxed for people who want to remain unknown to rulers of city states
Oh God no, that’s not where I want this to go; that pretty much defeats the entire point. This is to expand our options so we can use the plural form of ‘options’ and not the singular and I’m optimistic there will be more.
I’m a QC analyst and we are fully Agile, so I’m required to attend ever. team. meeting. Discovery, story point estimation, design spikes, any day can be poorly handled emotional regulation day and whoever’s feeling it is making it everyone’s problem when all we want is to finish a few maintenance items and maybe add a comma to some text. Though the testers have nothing to do with this after story point until there actual code migrated to one of the testing environments, we are forced to bear witness to entire dev teams made up of people from three to eight countries, whose only common language is English and as often the only native speaker, I am the only one who can’t mutter not very goddamn quietly in my native tongue that no one else understands; this may have been my motivation at one point to learn Welsh on Duolingo. A Project Manager making three times more than anyone else in the room sometimes swoops in during SCRUM two weeks into our sprint cycle to be perky at us and–on far too many occasions for this to be random–informs us the acceptance criteria had a couple of updates before swooping back out to PM something else’s life. We all hate her quietly until someone who went to check JIRA notes there are double the number of criteria and the user story is not the same in any way;. then everyone but me gets to hate her verbally with no one the wiser. I maintain bitterly grudging silence because everyone in the room speaks English, sometimes better than I do, and they have been in Texas long enough to pickup conversationally hostile Spanish. Our scrum master will either grimly pretend it’s always been this way or very blatantly not care.
At final demo as the tester, I will perform a dramatic rendition of ‘page with comma’ and ‘title:justfication left’ or run batch scripts in terminal while they watch absolutely nothing happening and nod wisely. Half the people in attendance wears suits for a living and have never used a computer; they have secretaries for that. Two worked with my mom and are quietly judging my performance and find me lacking. One stakeholder will ask a thousand questions, five of which have any relation to what we’re doing and I am expected to answer with no discernible change in my performance. Someone is watching TV and can’t be fucked to turn down the volume. Everyone else sits in eerie silence and I might hear a snore. Every one of these people are considered qualified enough to decide if we’re did a good job and sign off on it so we can finally end the sprint and the code can be added to the next release to production. No one feels a sense of relief or satisfaction; at least one dev hasn’t slept since the PM destroyed our lives and may be clinically insane.
Our sprints last four weeks with a prep week in between; we will experience some version of this cycle of dev hell roughly eight times a year and sometimes involving the legislature making their lack of time management all of our problem. Only one sprint will go as planned. One.
The worst part is; despite this, knowing full well what hell is before me, I went back to college for software development of my own free will.
You could do what Oauth does, allowing many providers to create credentials. That’s what some sites already use to let you login with google/Facebook/etc on their site. Except you theoretically could use any arbitrary sites you trust.
and then when your main instance shuts down you can’t log into any again. So what’s the benefit asides from bypassing defederation? (And this wouldn’t even be a benefit, because instances defederate because they don’t like the users, so if you let people log in with oauth from a hated instance then you’d also get defederated
You don't create a login for each server, you create a single account on a single server and then interact with people and posts on various servers. You don't login to other servers because it wasn't designed to work that way, and it isn't necessary.
Email is a good parallel. I make an email account on ProtonMail, and so that's where I log in to read and write emails (to other users, potentially on other servers). I can't use that same username and password to log into GMail, because that's a different email service provider altogether. You certainly don't need to make multiple email accounts if you don't want/need to.
In a way yes it’s similar to email need to know if your @gmail or @yahoo.
As for “important” people, same noteworthy as any other thing. Only extra they could do is if they are with a company could have a server that is @target@mbl or @meta (though everyone might block the latter xp)
There is a way I know of to have a federated and decentralized identity system, but it involves blockchains and will immediately draw the ire of anyone that hears the forbidden words describing it.
Did it still have that awkward immutability aspect to it? Imo that’s always been one of the other major downsides to the tech for wider use cases (the others being the scalability problems that in turn contribute to the energy problems).
Imo identity is way too dynamic to make sense making immutable records of, despite so many real world systems treating it as static.
I keep thinking we need a way to become our own personal IDPs, then we can have both. But if too many people find the current state of the fediverse confusing we’re never going to get a critical mass of people to manage their own oauth profiles and scopes.
So, anyone can spin up a Lemmy website. They're all independent sites, with independent and unaffiliated admins.
In order to sign in to a website with a given set of credentials, that website needs to know something about those credentials. Importantly, they need to know something about your password.
And that's a security nightmare that no user should be ok with.
Now, there are single sign-on (SSO) possibilities, but for them to be universally accessible across the Fediverse, you either need to impose them on 20,000 admins across two dozen software implementations, or you need them all to a) agree to support SSO, and b) agree to support the same SSO options.
Despite the fact that most of these websites look the same, they're all completely different websites, and while they can be treated, on first glance, as having the same content, they're very different places run by very different people. They can't be treated like a singular entity.
Now, there are single sign-on (SSO) possibilities, but for them to be universally accessible across the Fediverse, you either need to impose them on 20,000 admins across two dozen software implementations, or you need them all to a) agree to support SSO, and b) agree to support the same SSO options.
Yeah, this is the real crux of the issue and is a large unsolved problem. We simply have no standardized system for decentralized identity verification.
SSO works as a way of maintaining identity across the fediverse, but that's not really federating identity so much as it's getting all instance to offload identity verification to various central services.
I believe I heard Microsoft had a research project in the area of decentralized identity verification but I don't know if it went anywhere or how suitable it would be.
But do we need some kind of SSO layer with DID verification? All I need to prove my identity anywhere, technically, is my private+public keypair. As long as I hold on to this keypair, distribute it between apps/computers, back it up, I could log in anywhere on a federated platform and use it.
I hope we're going to see key-based decentralized identity on ActivityPub at some point... Having accounts tied to instances is just not very robust or scalable.
The matter of fact is , just in simple terms for SSO to work, every fediverse implementation has to agree on a standard for federated authentication.
Maybe, I’m just not seeing the issues or don’t really grasp fediverse and it’s implementations yet.
My idea, every fediverse instance is unique (no matter the implementation, i.e. mastodon, lemmy, pixelfed,…).
@masterspace@mango_master@Kichae
…
If that’s given, every entity (@‘person, @‘community, …) on each instance is unique.
Therefore, there can never be a duplicate identity = <entity>@<instance.domain>
Which allows the general assumption (all implementations adhere to the standard) each instance (homing instance, where the user is based) can verify the every identity within it’s domain.
…
If your instance shuts down your posts will still be visible on the other servers that your instance was federating with. Which might raise concerns if you want to have them removed, but that's another issue.
On Mastodon it's possible to move from one instance to another, taking your followers and the list of people you follow along with you and having the old account point to the new one. In the threadiverse, the most important feature would probably be to not have to manually re-subscribe to a bunch of communities. I think this moving of accounts from one instance to another will probably become standardized at some point in the future, so that you could for example move an account from Mastodon to Lemmy if you should wish. It's probably pretty far down on the list of priorities though.
In my opinion, the idea of a hierarchy of users as enforced on Reddit through karma is a bit obsolete. I think we're posting and commenting out of interest in the topic or a willingness to help or entertain. If that's the motivation, I don't see how starting over on a different server is such a bad thing; you're not really losing anything. We're not here hoarding upvotes like a dragon hoards gold.
This was thrown around a couple of weeks before the Reddit migration really kicked off, it appears to be excessively difficult to code. And it also doesn’t really fit with the system that Lemmy runs. It’s a great idea, but Ive been lead to believe that it is too difficult to create Although people do feel that account transfer would be a nice feature
From my understanding, a current goal is to make any account transferable, in case the instance the account is attached to decides to shut down/defederate?
If implemented, we can hope that won’t be tied to an instance shutdown.
well if we can move to another instance and migrate our saved posts, post and comments history, subscribed community easily this might drive adoption because people are used to centralized platform
This is why I’m not really on board with the people that advocate for others to seek out and join small instances unless they are older, well established, and active.
It doesn't work for everything though. Having a self hosted account that wasn't tied to any specific platform or instance would ideally allow you to have access to PeerTube and BookWyrm as well as Mastodon and Kbin, without having to worry about your instance shuttering and all of your posts and comments disappearing. I've also been really stewing on this idea, I think it's a probable future state of the Fediverse
Add comment