Follow

We're making good progress in our investigations to shift all of Matrix to use @[email protected] connect for authentication! Head over to areweoidcyet.com to see how we're doing and read the blog post at matrix.org/blog/2022/08/10/are 😱🎉🚀

@matrix Are there any updates on the passwordless logins (FIDO2) that people have been asking for since at least 2017? The issue on the issue tracker has over 50 👍

github.com/matrix-org/synapse/

This would be more secure and more decentralized. It'd also be less work for developers to implement and admins to set up. Still based on open standards too.

I'd love to hear a response on this.

@adam @matrix

"The bottom line is that Matrix should focus on being a decentralised communication protocol - not an authentication protocol… and by adopting a dedicated authentication protocol we can benefit from all sorts of goodies such as easy 2FA and MFA, passwordless-auth via WebAuthn, Login via QR-code, alternative CAPTCHAs and so much more."

@adam @matrix

I think OpenID should be first, then implementing new auth methods.
It would be more simple, clean and secure.

@didek @matrix

It sounds like we just disagree on priorities.

OpenID is also a move toward centralization. If OpenID is the only auth method in Matrix, the future is predictable. Most Matrix admins won't run an additional server (OpenID) and will use Google, Microsoft, etc.

If you bake an OpenID server into the Synapse package, then it's not really splitting out auth; it's the same people & package.

Multiple auth options, including OpenID is neither simple nor clean.

1/2

Sign in to participate in the conversation
Matrix.org's Mastodon

The social network of the future: No ads, no corporate surveillance, ethical design, and decentralization! Own your data with Mastodon!