Why can’t we have federated identity to login into fediverse instead of creating login for each instance?

  • Kichae@kbin.social
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    So, anyone can spin up a Lemmy website. They’re all independent sites, with independent and unaffiliated admins.

    In order to sign in to a website with a given set of credentials, that website needs to know something about those credentials. Importantly, they need to know something about your password.

    And that’s a security nightmare that no user should be ok with.

    Now, there are single sign-on (SSO) possibilities, but for them to be universally accessible across the Fediverse, you either need to impose them on 20,000 admins across two dozen software implementations, or you need them all to a) agree to support SSO, and b) agree to support the same SSO options.

    Despite the fact that most of these websites look the same, they’re all completely different websites, and while they can be treated, on first glance, as having the same content, they’re very different places run by very different people. They can’t be treated like a singular entity.