Programming

24972 readers

692 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 2 years ago

MODERATORS

snowe@programming.dev

Ategon@programming.dev

MaungaHikoi@lemmy.nz

UlrikHD@programming.dev

103

PoC - Use Matrix instead of emails for logins (codeberg.org)

submitted 2 weeks ago by TheOfficial@programming.dev to c/programming@programming.dev

30 comments fedilink hide all child comments

I wrote a proof of concept that allows the user to sign up to a service using their matrix ID e.g @user:server.test. The user then receives an activation link in an encrypted room from the service. It worked quite easily and within 2 days of fumbling around with the matrix SDK in python and FastAPI, here we are.

This has been in my head for a while and I just wanted to see if it's possible (the proof is in the ~~pudding~~ code). Emails are insecure and national services are starting to implement communication services on top of matrix. It's a not inconceivable that citizens might get a government issued Matrix account and communicate safely with the government over a secure protocol. Why not allow other services to do the same?

Imagine if instead of providing your email address for signing up to services you used matrix instead. Your host wouldn't be able to read your messages and it could replace things like 2FA codes over SMS, activation links in emails, or health documents from your doctor's CMS in your email inbox.

Should there be enough time, I'd like to try and contribute this login method to forgejo (the software behind codeberg that's hosting this repository), but let's see. First it would take learning go 😅

you are viewing a single comment's thread
view the rest of the comments

[–] TheOfficial@programming.dev 1 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

simplelogin provides email aliases? Using a matrix ID doesn't solve spam issues. The service could be hacked and all matrix IDs leaked and it would be the same as your email address being leaked.
So, an equivalent service or feature would have to be created for matrix that allows users to generate aliases for use with different services.

rambling of other (non) solution

Ooor, users could sign up with room IDs! That would actually solve the problem. As user could create a private room, copy the ID into the signup form, and the service would send messages into the room. It could save the list of participants in the room, i.e your matrix ID though 🤔 So not really a solution.

Good question! Thank you for asking. This would indeed require a solution and aliases built into a matrix server would be the best option. Maybe... uh... @JadedBlueEyes@programming.dev as a matrix server developer could think of something?

[–] JadedBlueEyes@programming.dev 1 points 2 weeks ago

For spam protection, we use tools like meowlnir or draupnir with the cooperation of the homeserver to allow completely blocking spam invites - so if a matrix ID goes evil you can leave the room you have with them and add them to a ban list, and you can subscribe to a variety of other ban lists to ban things in advance