I don't disagree, but in my opinion, this problem should be solved on protocol/standard level not by third-party developer like myself
Doing this for random web apps is bad enough that you shouldn't do it, period. At the very least your README should be covered in warnings that it's a bad idea. Really the only scenario where it is sort-of maybe acceptable if is a homeserver hosts additional software for its users (and then it shouldn't allow any other homeserver to be entered).
Re:Sign in with Matrix
by kitkat_new on Tuesday November 16, 2021 @10:03AM
(#29241291)
afaik everyone can initiate a Matrix Specification Change by following the described process:
https://spec.matrix.org/v1.1/proposals/
But seriously, no, obviously if you were to foolishly type your credentials for service A into a web form on web site B, now B has your credentials for A. Doesn't matter if that's a username and password, SMS code, TOTP. The only case where you aren't in serious trouble is WebAuthn (and its predecessor U2F) and that's because WebAuthn is bound to the actual DNS name of the relying party to defeat exactly this attack.