4mo ago

Any arguments against separating identity from instance/platform? (single identity across the fediverse)

I am sure it was discussed here before, but I can't find a good way to search this community.

Are there any arguments against having a user's identity federate, and be compatible across platforms?

For example, let us say I sign up with my instance, matcha_addict@lemy.lol

But what if I go on mastodon, and I want to have my own micro blog. Or maybe go to write freely and post some blog posts. I'd have to make a different account on each one.

What if mastodon or write freely could just let me log in with my lemmy account (or lets call it federated account). This has several benefits:

users don't have to scratch their head on if I am the same person or not across these platforms
theoretically, someone following my feed can get updates on what I do on multiple platforms

Now I understand this would be difficult to implement and iron out all the edge cases, but am I missing anything on why it wouldn't be a desirable feature, given it is implemented?

You're viewing a single thread.

63 comments

We host instances for trans and gender diverse folk, to provide a space that explicitly puts their safety first.
Take away the idea of an instance as a community/identity/distinct space, and the goal for these places existing is gone. Instead of a community and a safe space, we become a generic bit of hardware that enables transphobes as much as trans folk.
That's not something I'd be keen to keep sinking my own funds in to to support.
What I'd much rather see is instance based accounts, however, with the ability to take over/migrate them from other instances, so that if an instance goes down, people can still keep their identity. It would also allow instances focused on protecting minority communities to keep doing that.
- This is a very valid concern and I should clarify a bit about the mechanism I have in mind.
  An instance admin can decide which instances it federates identities with, similar to how regular federation is done (but maybe these would have separate lists)
  So, in your case, you would only federate identity with instances you trust to have done proper vetting. It wouldn't be by default that having a federated instance means you have access to login the entire fediverse.
  
  White listing encourages centralisation because it makes it really hard for new communities/instances to develop the trust they need to be included in existing white list circles.
  
  This white listing will not impact regular federation, so smaller communities will still get the same benefit they get now. They will only not get identity (for logins) federation until they gain trustworthiness
  
  What do you mean by "federates identities with"? I mean users are already federated, you can see my profile on your own instance. What is the mechanism you're talking about?
- What I’d much rather see is instance based accounts, however, with the ability to take over/migrate them from other instances, so that if an instance goes down, people can still keep their identity. It would also allow instances focused on protecting minority communities to keep doing that.
  This exists right now. It has existed for longer than Mastodon, much less Lemmy.
  Established by Mike Macgirvin in 2011 when he invented nomadic identity. First implemented in his Zot protocol from 2012 and a Friendica fork named Red, later Red Matrix, known as Hubzilla since 2015. Also available on (streams).
  Not just a vague concept or an experiment, but daily-driven on stable servers since over a decade.
  Nomadic identity goes even further than migration. Nomadic identity allows you to have the same Fediverse identity with everything in it (name, posts, connections, settings, files etc. etc. pp.) on multiple servers simultaneously. Not dumb copies. Bidirectional, near-real-time, live, hot backups. Whatever happens on one instance of a channel will be sync'd to all others almost immediately.
  One of the clones goes down, doesn't matter. The main instance goes down, doesn't matter, you can use the clones just the same. The main instances goes down and stays down, doesn't matter, you make one of the clones your new main instance. All your nomadic connections are automagically changed to your new identity based on your new main instance. Yes, even on remote servers.
  Even migration is based on the same concept. If you move from one server to another, first a clone is created, then the clone is declared the new main instance, thus demoting the original instance to clone, then the old original instance is deleted and the account with it. Not only can you move with absolutely literally everything, but you don't leave any rubbish behind on the old instance.
  Only downside: It does not work on ActivityPub. Yet. It requires a special protocol, either Zot (Hubzilla) or Nomad ((streams)). ActivityPub-based projects don't even understand nomadic identity. So when you move, you have to reconnect all your non-nomadic followers.
  ActivityPub implementation is being worked on, at least in theory. But the guy behind all this has, well, apparently not fully quit, but dramatically slowed down.
  
  Yep, it was one of his posts referring to implementing his existing approach to AP that I was thinking off!
  
  We'll see what comes out of this.
  Mike has already implemented FEP-ef61 on (streams), and it seemed to have worked well under lab conditions. But then he rolled it out to release in July. Channels created on accounts registered after that point have decentralised IDs already. And surprisingly, it caused tons of bugs to the point of these channels not properly federating with anything. And since he's the only (streams) developer, he had to iron everything out himself. And quickly so because a few dozen people use (streams) as a daily driver.
  In mid-August, he forked Forte from the streams repository. It was his vision of "the Fediverse of 2030": basically (streams), but only supporting ActivityPub anymore, with both (streams)' own Nomad and Hubzilla's Zot6 ripped out. Guess the idea was to have something with no extra protocols standing in the way of straightening FEP-ef61 and nomadic identity via ActivityPub. But this caused even more of a workload.
  On August 31st, Mike sent a private post to his immediate connections (his channel is set up to send private posts by default) that said that he quits. He wanted to stop developing for the Fediverse because it got too much. The community could carry on if they want.
  Trouble is, there's nobody among the few dozen (streams) users who has got what it takes, namely both the time and especially the skills to take over as a lead dev. One guy is ambitious, but he has only recently taught himself git just to make his own pre-FEP-ef61 branch for personal use. Then there are a few people who do know git, who may also know how to code, but who don't have the time.
  We got one offer by a guy who wanted to rewrite (streams) from scratch. He had taken a look at the (streams) code, and he said that some of it is very old and crufty and mouldy. Of course, a lot of code probably still dates back to 2012 when Mike forked Red from Friendica to implement nomadic identity and rewrote the entire backend against Zot. Problem was, I think that guy came from Mastodon, he probably hadn't even seen Friendica in action, much less Hubzilla or even (streams), and he described himself as "thick", so we'd have to explain everything to him. Nobody even reacted.
  Luckily, Mike is still Mike. He can't keep his fingers off improving the Fediverse. Every couple days, we see commits to the streams repository and/or Forte. It's just that things are moving forward very slowly now. The community is trying to figure out what and where the bugs can be by examining log files and whatnot, but nobody can track them down in the source, much less fix them and submit a PR, and that isn't talking about merging the PR.
- Maybe failover identities that consume the primary identity’s activities as a log. The failover identity (let’s call them jump clones for fun eh?) can be stood up as primary if the primary goes down (gets banned, instance dies, etc)
- the ability to take over/migrate them from other instances, so that if an instance goes down, people can still keep their identity
  I can definitely see user migration from one ActivityPub server to another being a possibility, but I really don't see how that can happen if one of the servers is down. That's too late then. If you could migrate a user from a server that is down, what prevents you from migrating a user from a server that is still up and doesn't want to do the migration? You could just pretend that it is down and do the migration anyway? I have no idea how that would work.
  
  The proposal I saw was basically a way of "signing" your posts, and then when they federate somewhere else, you can create an account on another instance and "claim" the posts that have federated there as yours, with your private key.
  Obviously, you couldn't access posts that never federated to the instance in the first place, but even with some lost content, it would let you edit, and post new content.
  And as I understood this proposal, basically, you could have multiple active accounts, all of which are "you", and allow you to control your content with the same permissions.
  
  Yea that could in theory be possible - the big problem is that it requires people to hold their own private key and manage that, both securely and conveniently. And well... tbh I just don't see that happening. If you need to keep your own private key and also keep your own password, I really don't see any non-techie people ever using the fediverse.
  There's also the issue that if that private key is leaked, there is no going back. Your identity is stolen and you can do nothing to take it back. This is different from if your password gets leaked - in that case, an admin could in principle step in and reset your password and you could regain control of your account. This happens all the time when people's Facebook accounts get "hacked". They report it to Facebook and get their account back. This is impossible if it relies on a user-held private key.
  It's a neat technical solution that unfortunately forgets the human, as is often the case.
  
  Why would you need a password if you already have a private key?
  Also, one possible way to manage private keys is to split the key (and the risk/burden) using shamir's secret sharing and use that process for key recovery if you ever lose it. For example you split it among 6 people you trust and to recover the key, 4 of them need to give you a fragment of it.
  https://en.m.wikipedia.org/wiki/Shamir%27s_secret_sharing
  
  Yea in theory you wouldn't need the password if you have the private key but here the key is only used for signing, maybe not for login. If it also needs to be backwards compatible. In any case, I don't think user-held private keys is viable.
  Sharing with trusted parties... I dunno, I think again it's too technical and complicated to do it. And you'd need people on the platform you trust to already be there.
  
  No, the key fragment is just a bit of text you can send to them by whatever secure side channel you want down to handing them a flash drive. Then when you need to recover the key you ask for it back
  
  a bit of text you can send to them by whatever secure side channel you want down to handing them a flash drive
  Normal non-technical people are never going to do this. It needs to be easy as clicking a button, otherwise it will never happen for them. Again, this is a neat technical solution but it completely forgets the human.

63 comments