Log in
| 1 | ||
| 1 | ||
| 1 | ||
| 1 | ||
| 1 |
It is now possible to sign up using Github. I added Github first for the following reasons.
That said, I do want to add more sign-in options. And they probably should cater more to the alternative web. But also broad accessibility. So I should likely target options down both lanes.
Which additional sign-ins should I add first:
 | |
|---|
For those worried about "too much" corporate integration and privacy. Sign-in with OAuth does not give a corporation knowledge of your account or any details here. Facebook/Google is not going to be able to spy on you in any way enhanced beyond their general public scraping. It just gives people who don't want to come up with a password a one click way to get in.
Also, if you already signed up with a password but would like to use github you can bind your github by following this link.
Of course spotting bugs and giving suggestions is welcome and encouraged.
What are the pros and cons?
How does OAuth relate to the list?
I'll prefer to avoid the convenience trap of using Google/Facebook logins if I can help it - but understand how it could help some - including my WEFreedom folks.
HumHub setup had a bunch of free addons for such login stuff. I added them, but there were more hoops to jump through to make each thing work.
In terms of pros and cons and where the convenience trap is:
If you use OAuth for everything, now whichever identity provider you use could shut you off of everything. If you already setup with a password, that can't happen here because you would also have the password route in. Same with anything else where you've signed in both ways.
The second downside is depending on who is running the client end, they could opt to exchange more data. Though technically they can do that without OAuth. Emailing Google a copy of their database would be an odd thing for a site to do. But technically they can do it with zero OAuth involved. What data comes the other way can monitored when you agree to a new OAuth because the provider's page should be telling you what info the client end is requesting. The issue is two fold. One is who looks at that? So someone could request to access a lot and you might miss it. That's similar to the problem with Android apps that request all the permissions. People can always say no. But do people say no? And two, while I'm requesting the absolute minimum from github, I do end up getting github user id (not name the way I'm accessing it and storing it). But even at the minimum permission level the request to get the user id actually comes back with a lot more than I need. I can research what's in it if you want. I didn't even look. I can comment here tomorrow with that if you want.
That last one is why I'm tempted to turn submatrix into an Oauth provider itself, where the returned user identifier depends on both the user and the app requesting it. And no other data is given. This gives them an id that can't be used to identify them in any other system. The only thing the client side needs really is knowledge the they are a distinct person. That's it. That would make submatrix a wrapper. You could sign into submatrix with anything. And then sign into anything else with submatrix (if I can market it), and share less data than even the default minimum.
So long story short. The downsides of OAuth is that you are trusting the bigger corp to not lock you out of your smaller site accounts. And you are trusting the smaller sites with a bit of privacy, though not a ton. This is in contrast to trusting smaller sites to hash passwords correctly. And it seems to be major companies that fail at that more than anyone else anyway.
Maybe I'll get that bitcoin signature sign in running again and you won't have to trust either. I probably could do something similar with pgp as well.