I think we should slightly rethink how login works on most Fediverse apps (Mastodon, Lemmy, but not only)

secret300, 10 days ago

I mean yeah that would be alright but like… Is it that hard to type a website? And most apps you don’t have to, it’ll list like the top 30 instances to just select from

ginerel, 8 days ago

It's not really hard to type a website, it's rather hard to remember it. You remember your username. Okay. But where were you? mastodon dot what?

When you use your full address, it's not that hard to remember it.

Kaldo, 11 days ago

I wish i could host my own simple lightweight identity provider and authenticator that is used for fediverse instead of creating accounts everywhere. Relying on fediverse to maintain both content, but also account info, seems like a really bad idea in retrospect (even if one day we get proper ways to migrate accounts but not even Mastodon does that well yet).

It's probably be relatively easy to establish services offering these for less tech savvy people later so they can just have a central identity service with which they can roam around in any fediverse they want later.

covert_czar, 11 days ago

Pixelfed have a simple workaround Finding usernames on servers and choosing between those I’m that Gen-z app only kid and i also use a password manager like bitwarden/keypassxc to store all my passwords

covert_czar, 11 days ago

My 2c: People find Mastodon/the Fediverse difficult because it was thought for desktop web browsing first. Question

I don’t know if anyone realized this, but there is a significant difference between logging in to a Fediverse service vs. a centralized service on mobile, compared to logging to a Fediverse service vs. centralized service on the desktop. So let’s round them up. Let’s compare logging in to Facebook vs. logging in to a Mastodon instance (that is not .social, since we strive for decentralization, right?)

How to log in to Facebook on the desktop:

<span style="color:#323232;">Open your browser
</span><span style="color:#323232;">Go to facebook.com
</span><span style="color:#323232;">Enter your login details
</span><span style="color:#323232;">Press Log In
</span>

All you need is a username and a password.

How to log in to a Mastodon server on the desktop:

<span style="color:#323232;">Open your browser
</span><span style="color:#323232;">Go to the server website
</span><span style="color:#323232;">Enter your login details
</span><span style="color:#323232;">Press Log In
</span>

So far so good, right? Everything seems normal, all the steps are all it takes to log in on both sites. Now let’s switch over to your mobile phone and log in to Facebook (presume you have all the apps needed installed beforehand):

<span style="color:#323232;">Open the Facebook app
</span><span style="color:#323232;">Enter your login details
</span><span style="color:#323232;">Log in.
</span>

Now let’s switch over to Mastodon:

<span style="color:#323232;">Open the Mastodon app (of your choice)
</span><span style="color:#323232;">Type in the server you have your account on
</span><span style="color:#323232;">Enter your login details
</span><span style="color:#323232;">Log in
</span>

See the difference? Your app is not an app, but rather a browser as well. Instead of the app directing you wherever you need, you have to tell the app where to go.

Now, for people like you and me, who might have had the internet experience before the smartphone was so popularized, this might not really be such an issue. We know how to open websites and browse the web. But for those who grew during the smartphone age, this is a significant burden they need to overcome. They need to remember, like, 3 things, instead of just two: the username, the password and the website. This is not necessary for the likes of Facebook (as in my example), where only 2 things need to be known: the username and the password. One less thing to remember is always better.

And I would also argue that among the former group, there might be also people who might not understand: hey, I downloaded an app, why do I have to type in the website as well in there? Don’t I have a browser if I need to type out websites?

I intentionally omitted the fact that on the official Mastodon app, you need to select the option to join another server or whatever, so an extra button, in order to simplify things and keep it more in line to how other apps ask you to do.

So I only see two solutions to this problem, as more and more people access their services via an app, rather than a browser:

<span style="color:#323232;">Make the app use the email address of the user and the password, as present on that specific server, and interrogate all servers (would also be a tremendous hassle and might even pose a security threat).
</span><span style="color:#323232;">Make the Fediverse even more like email and ask people only for their Fediverse address and their password - this is also more in line to how email clients work. The user would not have to bother to remember the website name, so that would be an extra.
</span>

I also find more fitting to call servers/instances websites instead when talking to absolute beginners, because that’s what any of these people see in front of them when they open a browser. Not a server, not an “instance”, but a humble website where it says powered by Mastodon.

Here are my 2c about this. What do you think?

h3ndrik, 11 days ago (edited 9 days ago)

I’d agree. Either have a “Register” link that leads you to a website explaining how to choose an instance and register there. Or maybe a drop-down menu with choices of instances and you can put in custom text if your instance isn’t amongst the defaults. That’s certainly not ideal as it prefers some instances over others, but maybe okay. Regardless, the onboarding process could be easier.

(And do away with the passwords, I think they’re an annoying concept and should go away for good in the future.)

ericjmorey, 11 days ago

Wouldn’t it be better (if doable) to take some cues on how actually email (and XMPP for that matter) works, and ask the user for the username and the password instead in one go?

I have to give my email app a lot more information than a username and password. So I’m not sure what you’re envisioning.

WhoLooksHere, 11 days ago

So who stores the login information? This is fundamentally the question here.

If you store it centrally you only need to ask for username/password combo.

But then someone needs to store it at a central location for everyone to check against.

If it’s not centralized than the user needs to provide it

Email has a hidden trick up its sleeve and that’s the domain name. In order for an email to be valid, the domain name must contain email info on its DNS records. There’s where you can imply knowledge about where the email/message is to go.

But here in lemmy, my email is just Gmail. There’s no way to find the information on where authentication could be located. Which brings me back to the top of centralization vs decentralization.

marcos, 11 days ago

What I understand the idea is to ask you to enter WhoLooksHere@lemmy.world in the username, and your lemmy.world password.

What I understand is happening (from the comment, because I don’t use apps) is that the app first expects you to choose lemmy.world in a list, and then asks you about your name and password.

Honestly, I have no idea what is easier for anybody. Both seem very equivalent to me. Also equivalent would be asking the server, username and password on the same screen.

Almrond, 11 days ago

To be fair, I use Summit and it just gives you one login box with a drop-down menu that has all of the major instances in it. I think it’s an implementation issue more than a design issue