Is decentralised federated social media over engineered?
Can’t get this brain fart out of my head.
What would the simplest, FOSS, alternative look like and would it be worth it?
Quick thoughts:
* FOSS platforms intended to be big single servers, but dedicated to …
* Shared/Single Sign On
* Easy cross posting
* Enabling and building universal Multi-platform clients.
* Unlike email, supporting small servers
No duplication/federation/protocol required, just software.
Single Sign On doesn’t mean that “American BigTech Servers” have to be used.
Essentially, for the users, it means that an account for site A can be used to login on site B because site A and site B trust each other.
A concept to Google if one wants to know more is “federated login”.
Yea this is exactly what I was thinking about.
The idea being that there would be circles of trusted platforms and once you have an account with one you have an account on all of them. Which, I imagine, would allow easy/quick cross posting from one platform to another when desired and make it easier to build and maintain an aggregating client that allows you to view all the platforms within such a “circle of trust” that you’re interested in through a unified interface.
@maegul How would servers share accounts and passwords? Allowing any server to know what a user’s password should be is not very good for security.
@fediverse @maegul @1984 @mindlight
@Aatube @maegul@hachyderm.io @1984 @mindlight @maegul@lemmy.ml
Couldn’t it be like public-private keys such PGP protocols, where the users have the private key and the platforms have the public key? It’s seems quite good privacy, some would even say it’s “pretty good privacy”.
@Sean Nice pun :D
I don’t think requiring users to use a really long and virtually unmemorizable password (the private key) would be a pretty good idea for a social network either.
@fediverse @maegul @1984 @mindlight @maegul
@Aatube @maegul@hachyderm.io @1984 @mindlight @maegul@lemmy.ml
The private key doesn’t need to be memorized, it stays saved on the device that the client software is on, allowing the user to integrate mobile device’s biometric reader (fingerprint/face/iris/whatever) to confirm identity, or use security key, there are already different ways to implement it that doesn’t require pw memorization.
I’ve got a long unmemorizable string for Firefox sync, Brave, Proton Mail/Pass, it’s still more secure than pw memorized
@Aatube @1984 @mindlight @maegul@lemmy.ml
Yea I don’t know the best approach to that. Either a separate server for managing IDs. Or you always a principal server that manages authentication for its platform and others within the trusted “circle”. And then, should the principal server fail, you can switch to another server as your principal. Hubzilla/Streams has some process like that AFAIK.
Trusting other peoples identification and authorizattion isnt about sharing accounts and passwords. If user A of server X want to log in at server Y, server Y asks server X if it knows this user A. If so server X handles the password/mfa check and just gives the green light to server Y.