Cactus Comments: Federated web comments based on Matrix protocol

Re:Cactus Comments: Federated web comments based on Matrix p... by CA0DA on Saturday March 06, 2021 @09:14PM (#26372518)

I'm excited about this - tried the demo, how do I know the site is not stealing my password? Shouldn't this use OAuth to solve that issue?

[ Parent | on HN ]

Re:Cactus Comments: Federated web comments based on Matrix p... by imwillofficial on Saturday March 06, 2021 @10:20PM (#26372826)

Because you don’t login via the site, you have to go through Matrix’ login flow, just like with any client.

[ Parent | on HN ]

Re:Cactus Comments: Federated web comments based on Matrix p... by southerntofu on Sunday March 07, 2021 @04:57AM (#26374609)

Then why does the popup on Cactus ask for the password? If the matrix homeserver is responsible for the authentication, then cactus should probably only ask for a matrix identifier (user:server).

[ Parent | on HN ]

Re:Cactus Comments: Federated web comments based on Matrix p... by imwillofficial on Sunday March 07, 2021 @08:15PM (#26381402)

On a second look, I agree.

[ Parent | on HN ]

Re:Cactus Comments: Federated web comments based on Matrix p... by carlbordum on Sunday March 07, 2021 @05:49AM (#26374827)

You don't, you have to trust it just like any other Matrix client. Hopefully there will be OAuth or something similar in the Matrix spec in the future, so you can use less trusted clients. If you want to comment with your user, but don't trust the client, you can use any Matrix client with Cactus Comments by clicking "Use a Matrix client" :-)

[ Parent | on HN ]