blake, 4 months ago

I don't completely understand #IndieAuth though. It appears to be a vastly simplified version of OpenID (which is great!), but unfortunately it also seems to be quite limited. I don't know if IndieAuth supports this (yet?), but with the Fediverse being as big as it is, it might not be a terrible idea to support double-@-style Fedi-handles in the login box (and then get Mastodon-and-friends to support it!).

lewiscowles1986, 4 months ago

@blake Do you mean IndieAuth the software, or RelMeAuth the idea?

It is just a metadata bridging mechanism that mandates OAuth + two sites / urls having rel="me" pointing at each other.

There are interesting notes about similarity to OpenID on https://indieauth.com/faq as well as links to implementations and discussions of complications over on IndieWeb wiki
https://indieweb.org/RelMeAuth

Mastodon supports OAuth and over at https://infosec.town/settings/verification you should see a rel="me" link to masto, but not from.

blake, 4 months ago

@lewiscowles1986 I'm talking about IndieAuth the standard. I don't see any mention of rel=me in that standard.

lewiscowles1986, 4 months ago (edited 4 months ago)

@blake
https://www.w3.org/TR/indieauth/#:~:text=org%2Fauth%22%3E-,5.2%20authentication%20request,-The%20client%20builds

specifically shows RelMeAuth, continues to use the me attribute to point to a user profile page.

I Believe that https://www.w3.org/TR/indieauth/#:~:text=this%20specification%20uses%20the%20link%20rel%20registry%20as%20defined%20by%20%5Bhtml%5D%20for%20both%20html%20and%20http%20link%20relations also confirms my bias towards rel="me"; although I think other methods may be supported, I'm not sure they are as popular.

I'm also not sure how prevalent, or popular 4.2 Client Information Discovery is. Certainly the IndieAuth service was integrating with services that I didn't see offering this. And I'm glad for that.