This is actually a very good description of the benefit of ... • Aaron Parecki

55°F

Karl McGuinness https://twitter.com/jankytweet • Jan 9
Client registrations are not also not portable across AuthZ Servers. As a dev you need to reg the same app with every ecosystem and manage credentials often static. End users often have no assurance besides logo and name that they are authorizing the same app in every ecosystem.

This is actually a very good description of the benefit of IndieAuth's use of URLs as client IDs.

https://www.w3.org/TR/indieauth/#client-identifier

Every app is identified by its URL, so you can build trust that way across providers.

Chicago, Illinois • 32°F

Thu, Jan 9, 2020 8:03am -06:00

1 reply
Have you written a response to this? Let me know the URL:
- Karl McGuinness twitter.com/jankytweet
  
  OIDC also supports a similar model for self issued providers openid.net/specs/openid-c… as well as proposal for stateless identifier as JWT tools.ietf.org/html/draft-bra…. I could see a remix of these ideas along with signed software statements. Still need trust.
  
  Thu, Jan 9, 2020 4:09pm +00:00 (via brid-gy.appspot.com)

Posted in /replies using monocle.p3k.io