WeChat ID
aaronpk_tv
-
Chloe Condon
https://twitter.com/ChloeCondon
•
Oct 8
I miss being a kid afraid that Y2K will mess everything up. 💻🔥
Instead I'm over here in my 30s worried that climate change will destroy the planet and genuinely concerned if I'll ever actually get to use my 401k because the earth will be destroyed. 🌍🔥
Don't worry, 2038 is just around the corner and is going to be way worse than the Y2K bugs. -
Want to see the action up close as we get ready for the big bridge move this weekend? Check out our timelapse camera located on the south side of the Blumenauer Bridge: https://app.oxblue.com/open/pbot/blumenauerbridge
#pdxtraffic #pdxbikes -
@goto
https://twitter.com/samuelgoto
•
Oct 8
Ah that's indeed a reasonable distinction. Still seems like solvable? Like Signal that uses a master identifier and then ephemeral (yet stable) ones?
Maybe, but at the end of the day I would assume any crypto will eventually be broken, so it's a game of picking good enough algorithms to avoid correlation in a timeframe that would be a problem. -
@goto
https://twitter.com/samuelgoto
•
Oct 8
Sure. I'm sure one could find a hashing function that would age well (I'm making an assumption :) but a lot of stuff breaks if one doesn't :)).
But there's a big difference in relying on a specific hash function for something that won't matter a day from now (validating an ID token) vs something that can be correlated years later (hashed identifiers in logs)
-
@goto
https://twitter.com/samuelgoto
•
Oct 8
LMK if you run into a good formulation.
FWIW email may be a good analogy and source of inspiration. In browser land, SHA256(user + RP)@idp.example does the trick.
Relying on sha256 as the end of the story seems like a thing that also won't age well. It's only a matter of time until we see sha256 the way we see md5 today. -
I actually thought I had already joined, but I haven't yet actually joined a meeting. It's a lot to keep up on with all the other spec work I'm in the middle of 😅
-
Aaron Parecki
https://aaronparecki.com/
•
Oct 7
Oh yeah, that's intentional. It'd be interesting to explore what it could look like otherwise tho.
I'm actually really interested in this particular problem right now since Sign In with Apple is probably the biggest example of differing IDs per RP yet the first thing the RPs want to do is resolve that back to an identifiable user. -
@goto
https://twitter.com/samuelgoto
•
Oct 8
No, in the sense are these designed such that two different RPs get the same global identifier for the same user?
Oh yeah, that's intentional. It'd be interesting to explore what it could look like otherwise tho.
