Just an idea to make the Fediverse better, what do you think about it? (lemmy.world)

submitted 9 months ago* (last edited 9 months ago) by thecookingsenpai@lemmy.world to c/asklemmy@lemmy.world

13 comments fedilink hide all child comments

I have this proposal for ActivityPub

NOTE: This proposal is based on https://www.w3.org/TR/activitypub/#authorization and https://www.w3.org/wiki/SocialCG/ActivityPub/Authentication_Authorization consulted on 06 January 2024.

Considering that the entire section on safety considerations is presented as non-normative
Given that "at the time of standardisation there are no strongly agreed mechanisms for authentication. " as per the above reference
Assuming that the ultimate goal is to have a decentralised, persistent and verifiable identity.

Premise: The following proposal represents a radical and potentially disruptive change to the current ActivityPub specifications. In particular the following parts:

ActivityPub clients authenticate to a server using OAuth 2.0 bearer tokens.
Related OAuth considerations

It is also important to note that the following proposal can coexist with current OAuth authentication.

The proposed encryption algorithm (ED25519) can and should be updated in the event of a vulnerability or major upgrade.

Suggestion

I have no idea how to write a document like this correctly, and I am probably doing it wrong, but my only goal is to stimulate discussion.

The proposal is as follows.

ActivityPub clients authenticate against a server using ED25519 signatures In general, bearer tokens can be easily replaced by signatures in almost every aspect. Advantages:

Servers don't need to store anything other than a session token.
Authentication is decentralised and context independent
Your key is your identity: no server breach can expose your data
There are mature libraries like node-forge (for nodeJS and TS) and many others that allow easy implementation of authentication.

I have tried to think about possible downsides, but the goal of this post is to stimulate discussion, please keep it respectful, but of course criticism and additions are welcome!

top 13 comments

sorted by: hot top controversial new old

[-] safesyrup@feddit.ch 6 points 9 months ago

Nice post, thanks. What I feel is missing is the reason for the proposal. Currently, I have no context of what it should replace or improve or what the motivation of the suggestion is. I think you should add a section of "how is the situation currently" and "what should be improved and why".

[-] thecookingsenpai@lemmy.world 5 points 9 months ago

Will do, thanks! The main reason is to solve the following "problem": in a decentralized protocol like ActivityPub I (personally) find very weird that accounts are bound to a central instance. I have like 6 "thecookingsenpai" accounts across instances (I of course use only one of them but you get the idea) and if by disgrace lemmy.world collapses overnight I could not log in with my account elsewhere.

[-] 1984@lemmy.today 2 points 9 months ago

How are the accounts bound to a central instance when you have accounts on many instances? Sorry if I don't understand...

[-] thecookingsenpai@lemmy.world 1 points 9 months ago

My account https://lemmy.world/u/thecookingsenpai is not the same as https://lemmy.ml/u/thecookingsenpai or any other instance. Thus, each account is bound to the instance it was created on, although it can interact with other instances

(aka if lemmy.today disappears you would have no account to log in with)

[-] Bluetreefrog@lemmy.world 5 points 9 months ago

Wrong community. OP, please repost in !fediverse@lemmy.world

[-] deegeese@sopuli.xyz 3 points 9 months ago

I’m a developer and I use OAuth 2.0 for work but half of this is Greek to me. You should post in a developer forum instead of general Ask Lemmy.

[-] thecookingsenpai@lemmy.world 1 points 9 months ago

True, I just wanted to be more generic before going technical (this is very vague from a tech point of view so i was testing how the idea could be reacted)

[-] deegeese@sopuli.xyz 4 points 9 months ago

You should explain the problem you’re trying to solve instead of diving into your proposed implementation.

[-] thecookingsenpai@lemmy.world 1 points 9 months ago

Will add, you are totally right

[-] LanternEverywhere@kbin.social 4 points 9 months ago* (last edited 9 months ago)

You need to start with an elevator pitch. Like 2 sentences in simple words saying what the problem is that you're trying to fix, and what your proposed solution is. Like for the fediverse it would be something like this:

It sucks that a place like reddit can totally change how their website works after millions of people spent so much time and energy making it a great place. But with the fediverse, communities are distributed among many different websites, so no single website can destroy the community later after people built it up.

[-] leraje@lemmy.blahaj.zone 2 points 9 months ago

Seen this?

[-] thecookingsenpai@lemmy.world 2 points 9 months ago

Woah, nope. Thanks, digging in it!

[-] thecookingsenpai@lemmy.world 1 points 9 months ago

https://app.mypod.store/invite/https%3A%2F%2Fmypod.store%2Fthecookingsenpai%2Fdata%2Fcapabilities%2F207c381c-2ece-4ce3-b188-1ee1bc4c5c03

If i did it right

this post was submitted on 19 Jan 2024

10 points (72.7% liked)

Ask Lemmy

26749 readers

460 users here now

A Fediverse community for open-ended, thought provoking questions

Please don't post about US Politics. If you need to do this, try !politicaldiscussion

Rules: (interactive)

1) Be nice and; have fun

Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them

2) All posts must end with a '?'

This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?

3) No spam

Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.

4) NSFW is okay, within reason

Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com. NSFW comments should be restricted to posts tagged [NSFW].

5) This is not a support community.

It is not a place for 'how do I?', type questions. If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.

Reminder: The terms of service apply here too.