Relevant Fediverse Enhancement Proposal (FEP) here[0] and discussion here[1].
Auth can be subtle and I'm likely missing some things, but the UX appears to be essentially equivalent to OIDC, especially given the caveat at the bottom which states users might want to consent before exposing their identity to any random server.
So I'm assuming the benefit here is that the logins themselves and any actions you take are tied to your public key and not the domain you use to host your key at any given point in time? Do they talk at all about the typical issues with PKI identity, ie lost/compromised private keys?
Comments
Relevant Fediverse Enhancement Proposal (FEP) here[0] and discussion here[1].
Auth can be subtle and I'm likely missing some things, but the UX appears to be essentially equivalent to OIDC, especially given the caveat at the bottom which states users might want to consent before exposing their identity to any random server.
So I'm assuming the benefit here is that the logins themselves and any actions you take are tied to your public key and not the domain you use to host your key at any given point in time? Do they talk at all about the typical issues with PKI identity, ie lost/compromised private keys?
[0]: https://codeberg.org/fediverse/fep/src/branch/main/fep/61cf/...
[1]: https://socialhub.activitypub.rocks/t/fep-61cf-the-openwebau...