this post was submitted on 09 Jun 2023
288 points (99.7% liked)
Lemmy
12444 readers
15 users here now
Everything about Lemmy; bugs, gripes, praises, and advocacy.
For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It feels like user accounts need to be abstracted away from instances somehow. Federation means it's almost meaningless which instance you register with, and as integration between instances and other Fediverse apps gets better it will just become more and more meaningless. It should be possible to just "Join Lemmy" and have the servers behind the scenes handle spreading the load. You should be able to login to Lemmy from Beehaw.org or Lemmy.ml or any other Lemmy instance. The way it works at the moment is kind of like content is global but accounts aren't and it feels like it should be the other way around?
We need to build some kind of SSO that allows Lemmy users to authenticate with the same account on any instance, but will appear as if you're still using the instance you registered on. That way you could just login to another instance if your 'home' instance goes down for whatever reason.
https://github.com/LemmyNet/lemmy/issues/2930
I like the sound of this, just unsure how this would be able to authenticate an account on behalf of a home instance that's down, in a trustworthy way.
I'm not familiar with the inner workings of Lemmy and the Fediverse, so the following is based on similar implementations I'm familiar with...
SSO implementations usually require the website the user originally registered on (home instance) to confirm the account is real and authenticate it, and in most cases a new user account is automatically created using the SSO authentication details (this would prevent the user from appearing as if they're using their home instance).
To achieve what you want, I think we'd need some kind of way to export the user account and any signing keys used to prove the user is who they claim to be in the fediverse, and then re-import those to another instance. I'm not too sure if SSO would be able to achieve it if the home instance is down.
On the flip side, I'm pretty sure SSO with a Lemmy instance that is active could work. While it would bring a lot of benefit to less tech-savvy users, and a lot of convenience to us when we're given a threadiverse link to another instance, from a technical perspective I think that would be a challenging implementation. Users would need to be careful about having their credentials phished on a malicious instance too
i'd also be worried that some corp would try to take control of the centralized sso mechanism and thus control the user base. imho we must avoid the instinct to centralize anything.
but potentially maybe there's a federated directory where people could register and be assigned a server to do load balancing to key problems like lemmy.ml are experiencing (?)