News for hackers. Stuff that matters.

A comment on Sign in with Matrix. Parent comment

Re:Sign in with Matrix by dxld on Tuesday November 16, 2021 @09:17AM (#29240761)
Crazy idea: what if you use a random room ID as an OTP and recognize the user as signed-in as soon as they join that room via an invite or matrix.to link? I'm not sure if this fits within your constraints since it would need a backend but I think it'd be pretty neat :)
[ Parent | on HN ]
Re:Sign in with Matrix by kadoban on Tuesday November 16, 2021 @10:28AM (#29241580)
That sounds like it would be dangerously MITM-able. Then any invite or link in matrix is equivalent to "let me log in as you" on some other random service.
[ Parent | on HN ]
Re:Sign in with Matrix by dxld on Tuesday November 16, 2021 @06:15PM (#29247467)
Ah you're right that would be pretty dangerous. I was hoping it'd be possible to avoid sending an OTP token the user has to paste but I suppose that's necessary to bind the two contexts together.

Then I guess I'd have the backend send the user a link with an auth token after joining, that way at least no pasting needs to happen.

[ Parent | on HN ]
Re:Sign in with Matrix by ushakov on Tuesday November 16, 2021 @09:49AM (#29241127)
i was considering somewhat similar approach, where if the user accepts a room invite i would authenticate them

but this doesn’t work, because there is only one standard method of authentication, which is by sending username/password

[ Parent | on HN ]
Re:Sign in with Matrix by 3np on Tuesday November 16, 2021 @01:57PM (#29244856)
...Why?

A matrix bot could send the user a short-lived token they can paste to the site to authenticate. Optional QR for mobile.

No need for homeserver changes, changing protocols or touching any user credentials.

Since you’d rely on an existing matrix session, the bot could send the token e2ee, meaning after TOFU you could even protect against malicious homeserver operators.

You could also do the inverse, having the user send the token to the bot.

[ Parent | on HN ]
Re:Sign in with Matrix by ushakov on Tuesday November 16, 2021 @02:43PM (#29245455)
this is neat and i have thought of that

but it does not authenticate you against the homeserver and does not grant you the access token, meaning the application would not be able to access Matrix APIs on user's behalf

[ Parent | on HN ]
Re:Sign in with Matrix by 3np on Tuesday November 16, 2021 @11:39PM (#29249339)
Why does a federated sign-in solution for a third-party web app need to authenticate to the homeserver or access Matrix APIs on the users behalf?!

That’s exactly what you want to avoid.

The bot can still get things shared by the user like username, avatar, 3pids and pubkeys.

Can you give me a use-case that my proposed solution is insufficient for due to inability to impersonate the user to the Matrix homeserver?

[ Parent | on HN ]