So, instead of having "buttons per federations", you'd just have one button, say "login" and that one button would aggregate the various accounts you have among the various federations that the website accepts.

Replying to

Sam Goto@sgo.to

Bluesky networkPosted13h ago

I was imagining that the relying party would be asking for various "federations" (identified by a URL, atproto, activitypub, indieauth, etc) and that the browser would aggregate all of the accounts from those "federations".

w3c-fedid.github.io/idp-registra...

I was imagining that the relying party would be asking for various "federations" (identified by a URL, atproto, activitypub, indieauth, etc) and that the browser would aggregate all of the accounts from those "federations".

w3c-fedid.github.io/idp-registra...

Replying to

@reiver ⊼ (Charles Iliya Krempeaux)@reiver.myatproto.social

Bluesky networkPosted1d ago

How were you imagining AP login working?

Was it using something at the AP level?

Or, using one of the other supported protocols?

(BTW, I think I remember Evan talking about formalizing how login is supported with AP.)

I'm proud about this move! Good stuff @opensource.google !!

Replying to

Google Open Source@opensource.google

Bluesky networkPosted1d ago

"This blog is about celebrating that friendship" with open source developers.

That was our first post in Feb 2008. Today, all 1,557 posts (2008–2026) live in the Atmosphere as verified @standard.site records:

https://opensource.googleblog.com/2008/02/welcome-to-google-open-source-blog.html

Welcome to the Google Open Source Blog

I'm in Dublin for TPAC too!! If you see me stop by to say hi!!

Replying to

Ryosuke Niwa@rniwa.bsky.social

Bluesky networkPosted3d ago

Anyone else going to W3C TPAC in Dublin this year?

Right.

That sounds right.

I think the same could apply to ActivityPub, with two parallel calls, between DNS and HTTP?

Replying to

P(aul) Frazee@pfrazee.com

Bluesky networkPosted4d ago

It was more that we had DNS for ppl who don’t run a server, and HTTPS mapping to support large deployments of users on subdomains which couldn’t provide dns records for each user

Doesn't AT already provide a http and a DNS resolution mechanism that aren't mutually exclusive?

Replying to

Emelia@thisismissem.social

Bluesky networkPosted4d ago

Even with it just affecting IdP's it's 6382 pds hosts that now need to change DNS or make sure they route the HTTP resolution correctly. It's all 43,012 fediverse hosts that if it's DNS based would need to take action. They're not small numbers, especially when this infrastructure is volunteer run

I think it wouldn't be too hard to provide a backwards compatibility fallback.

Replying to

Emelia@thisismissem.social

Bluesky networkPosted4d ago

But it's not just IdP's affected by handle resolution changes, it's some percentage of 47 million users, for whom login will silently break if they do not do something technical at their domain registrar or website hosting tool. That's why it's not workable.

IdPs are already going to have to redeploy to connect with the browser. They might as well expose the right things for the browser to figure out where to find things.

Replying to

Emelia@thisismissem.social

Bluesky networkPosted5d ago

There is: let the RP resolve the handle as they currently already do today. Handle resolution does not need to be covered by FedCM beyond that

resolveHandle(handle: string): Account[] | Error

Every app needs to do handle resolution anyway for other purposes, it's called when the input is submitted

Can you give a tldr of the idea? Is it a well known file somewhere in the domain that has a alsoKnownAs attribute that points to the actor URI?

Replying to

Bumblefudge@bumblefudge.com

Bluesky networkPosted5d ago

actually, we've been kicking around an idea where the DID indirection comes AFTER (i.e. optional for the 99% of fediverse without DID-controlled actors, because that's what alsoKnownAs was for), so it would be relatively easy for fedi devs to implement just the AP core without the DID extension.

Id love to hear more! Are you going to be in Dublin in person? If so id love to spend some good heads down time with you on Monday!

Also, if follow me I can DM you :)

Replying to

Bumblefudge@bumblefudge.com

Bluesky networkPosted5d ago

it's a little complicated for a microblogging thread, i'll just demo it to you monday in dublin on my phone or laptop :D

I think there isn't any option that im exploring that is able to keep everything backwards compatible and still able to make verification work: changing AP to accept different things is within scope.

We want to minimize change, but I don't think there isn't any option with 0 changes.

Replying to

Emelia@thisismissem.social

Bluesky networkPosted5d ago

Yes, but I'm saying it's not currently done for handles and isn't requiring usage of alsoKnownAs anywhere.

At least you didn't break the internet :)

Also, if ever become responsible for picking a private key, just make sure not to pick 4 :)

Replying to

Jim Ray@jimray.bsky.team

Bluesky networkPosted5d ago

This is the power of Talks Shit Jim 😎

Omg that confused me too, I was also assuming you Jim

Replying to

Jim Ray@jimray.bsky.team

Bluesky networkPosted5d ago

Now I’m even confused

Can you send me pointers to that? Something that I could read?

Yeah I was assuming it would work for the current deployment and handle system for AP. That's a lot of ground to cover.

Replying to

Emelia@thisismissem.social

Bluesky networkPosted5d ago

Well, only just for Webfinger kinda, but not for if the Handles Taskforce moves forwards and brings domains as handles to the Fediverse, which there's sufficient demand from the blogging apps for.

Actually, let me take this back, I actually do think that EVP (what we are using for verifying email addresses) can work out of the box for verifying AP handles (because AP doesn't have the did level of indirection that AT has).

Would it not?

Replying to

Bumblefudge@bumblefudge.com

Bluesky networkPosted5d ago

Right but proof of control of an email and proof of control of a DID and proof of control of a string in a given namespace (ATP handles, webfinger handles, etc) are three diff systems and the latter two do not fall out for free from the first on either protocol!

And for AP use webfinger to discover the issuer and for solid use content negotiation and turtle/jsonld to discover the issuer.

But once you know who the issuer is, use the EVP-like mechanism to issue.

Replying to

Sam Goto@sgo.to

Bluesky networkPosted5d ago

Yeah, that's what I had in mind: reuse the atproto DNS TXT record to discover the the did (or the .well-known/did.json when DNS fails) and from the did the did doc and from the did doc the issuer. So, same as EVP but with the did doc level of indirection.

Yeah, that's what I had in mind: reuse the atproto DNS TXT record to discover the the did (or the .well-known/did.json when DNS fails) and from the did the did doc and from the did doc the issuer. So, same as EVP but with the did doc level of indirection.

Replying to

Bumblefudge@bumblefudge.com

Bluesky networkPosted5d ago

actually ONE OF the ways atproto finds the issuer _is already_ via DNS TXT record (with a well-justified extra step for CID resolution) and there have been a few recent proposals to make a similar option in AP.... ( @thisismissem.social and @quillmatiq.com and @snarfed.org have proposed good plans)

Ironically, I implemented (small) parts of Google's WebFinger endpoint decades ago along with @bradfitz.com :)

Replying to

Bumblefudge@bumblefudge.com

Bluesky networkPosted5d ago

Speaking of which, there's a parallel universe in which a previous generation had & resolved this conversation 17 years ago and we don't have to think about it now. Not helpful to bring up here but definitely a funny "history rhymes" backdrop to this research query. techcrunch.com/2009/08/14/g...

Google Points At WebFinger. Your Gmail Address Could Soon Be Your ID. | TechCrunch

By that I mean, what i'm wondering, if we reused most of evp's issuance (which is not based on oauth) and verification, and introduced how resolution finds the issuer (which, for email, is based on a DNS TXT record -- and for atproto and activitypub likely different), then I think that could work?

Replying to

Sam Goto@sgo.to

Bluesky networkPosted5d ago

"the latter two do not fall out for free from the first on either protocol" -- I think that's correct but the only part that doesn't "fall out for free" is *resolution*, not *issuance* nor *verification*.

"the latter two do not fall out for free from the first on either protocol" -- I think that's correct but the only part that doesn't "fall out for free" is *resolution*, not *issuance* nor *verification*.

Replying to

Bumblefudge@bumblefudge.com

Bluesky networkPosted5d ago

Right but proof of control of an email and proof of control of a DID and proof of control of a string in a given namespace (ATP handles, webfinger handles, etc) are three diff systems and the latter two do not fall out for free from the first on either protocol!

Let me write down something not-terribly-embarrassing and I'll share it with you shortly.

(yeah that's an easy win. Bluesky's app too)

Replying to

bryan newbold@bnewbold.net

Bluesky networkPosted6d ago

I'm not sure! I haven't had a chance to digest it yet. I'd be curious to read what you are thinking.

(at a minimum atproto PDS implementations should probably look at adopting EVP during account signup, but that isn't what we are talking about here)

I think a lot of this presupposes that we would be using oauth for login that I don't think necessarily needs to be true. EVP isn't oauth and I think is holding up well.

Replying to

Bumblefudge@bumblefudge.com

Bluesky networkPosted6d ago

That gulf is massive for a truly/deeply dual protocol app, but for an app that doesn't need to "write durable events" to both protocols one can imagine a middle service like Bridgeyfed enrolling once and ever thereafter being able to do an ATP authZ flow.

Yeah for sure. I'm thinking only about login not authz.

Replying to

bryan newbold@bnewbold.net

Bluesky networkPosted6d ago

just login-with authentication (authn) feels easier to converge on.

there has been interest for some time in shoehorning atproto identity in to traditional OIDC environments. eg, AIP (linked), a "login to tailscale" project.

GitHub - graze-social/aip: ATmosphere Authentication, Identity, and Permission Proxy

Yeah I wanted to pull a bit more from this thread because I think we learned a bunch with evp and I think it has great properties.

I started to draft how we could generalize evp to handle atproto and ActivityPub, is this something that you think might have legs?

Replying to

bryan newbold@bnewbold.net

Bluesky networkPosted6d ago

I do think that the new Email Verification Protocol stuff (which you have championed!) reduces a whole lot of friction and might open up new possibilities.

I think I might take that offer :)

Replying to

Evan Prodromou 🇨🇦🇺🇸🇬🇷🇵🇸@evan.cosocial.ca.ap.brid.gy

Bluesky networkPosted6d ago

If you want to make something on the Fediverse, please make it. If someone tells you they don't like it or they don't think it's necessary, tell them they don't have to use it. It's a big Fediverse out there. Lots of open space.

@evan.cosocial.ca.ap.brid.gy @divy.zone and @bnewbold.net Im curious if you all have any thoughts on how these different systems should (or shouldn't?) play with each other.

Replying to

Sam Goto@sgo.to

Bluesky networkPosted6d ago

One questions i have been pondering on is "should an activitypub user be able to login to an atproto app?" and vice versa? What would that mean? What would the cross product of AP, AT, indie auth, LWS be?

Many atproto apps allow you to login with email (bluesky most notably), what does that mean?

One questions i have been pondering on is "should an activitypub user be able to login to an atproto app?" and vice versa? What would that mean? What would the cross product of AP, AT, indie auth, LWS be?

Many atproto apps allow you to login with email (bluesky most notably), what does that mean?

Replying to

Sam Goto@sgo.to

Bluesky networkPosted6d ago

I'm going to be hosting a session at TPAC next week in Dublin to have an open discussions on how browsers could help with atproto, activitypub, lws, indieweb, more specifically with identity!

www.w3.org/events/meeti...

I'd love to see you all represented there, remotely or in person!

26 October 2026 | Open-World FedCM for Decentralized Social Networks | Calendar

Baking a did:web resolution seems simpler for a browser, but did:plc is probably more involved (does the browser talk to the ledger?), but not entirely impossible? would it be desirable? dunno.

One big benefit that appeals to @divy.zone and I is making things backwards compatible, which is great.

... So, one option @divy.zone and I are evaluating is making the browser understand the atproto handle resolution system, so we would bake into the browser the translation from "@sgo.to" to the did and from there resolve based on the (built-in?) method (web/plc?).

So @divy.zone and I are wondering how we could make this work without baking into the browser the specifics of atproto/activitypub/indieauth/lws and so on ... we could, to some extent, but ideally it would be protocol-agnostic so that it is loosely coupled to avoid ossification ...

It is partially difficult, because I'm guessing we would want to make this work for atproto (@sgo.to), activitypub (@goto@w3c.social), indieauth (sgo.to), lws (sgo.to/me) and email (me@sgo.to), so I'm guessing we'd have to accept all sorts of different syntaxes and resolution mechanisms ...

One open design questions for you is "what happens when the user types their handle (e.g. @sgo.to) into that search box?" (and "what do we allow users to type?").

@divy.zone and I are brainstorming a few options, but we haven't managed to find anything great :( would love to pick you brains!

Oh, maybe I'll also run into @tantek.com.web.brid.gy and @aaronpk.com for IndieWeb?

I'm not as well connected to the LWS/Solid community, @erlend.sh would you be one step closer?

@bkardell.com anyone else at Igalia excited about this space?

@wseltzer.bsky.social my great FedID co-chair and agitator of the PLC!!! I hope that I can see you in person?

@evan.cosocial.ca.ap.brid.gy and I are attending in person!

Paging my co-agitators @divy.zone, @thisismissem.social and @bumblefudge.com !

@bnewbold.net I hope you can make it, but if not, I'll find you at IETF!

@dholms.at and @pfrazee.com here is an opportunity get atproto closer to browsers!

Replying to

Sam Goto@sgo.to

Bluesky networkPosted6d ago

I'm going to be hosting a session at TPAC next week in Dublin to have an open discussions on how browsers could help with atproto, activitypub, lws, indieweb, more specifically with identity!

www.w3.org/events/meeti...

I'd love to see you all represented there, remotely or in person!

26 October 2026 | Open-World FedCM for Decentralized Social Networks | Calendar

I'm going to be hosting a session at TPAC next week in Dublin to have an open discussions on how browsers could help with atproto, activitypub, lws, indieweb, more specifically with identity!

www.w3.org/events/meeti...

I'd love to see you all represented there, remotely or in person!

26 October 2026 | Open-World FedCM for Decentralized Social Networks | Calendar

Replying to

Sam Goto@sgo.to

Bluesky networkPosted1mo ago

@thisismissem.social @divy.zone and I recently went through an exploration of how the browser can help you login to websites with atproto accounts.

We recently presented to the FedID CG and here is a sneak peek in case you couldn't join!

This is early but we'd love your input before we go too far!

"The private key is the number 4"

scotthelme.co.uk/eight-bits-o...

omg

Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

Much better tagline than mine which is "make the web go brrrr"!!

Long live the web!

The permission-less web!

Replying to

Philip Jägenstedt@foolip.org

Bluesky networkPosted11d ago

Happy World Browser Day!

I've long used "long live the web" as my motto/tagline, so today I published a blog post explaining what this phrase means to me: longlivetheweb.org/not-a-manife...

Not a manifesto

Add first class support for short videos and compete with tiktok/instagram, rather than twitter.

Replying to

Jake Gold@jacob.gold

Bluesky networkPosted1y ago

The Bluesky Retention Problem was identified with certainty in late 2023.

In 2024, the Discover algo was supposed to be the solution.

In 2025, the Discover v2 algo is supposed to be the solution.

I genuinely hope that it is!

But I'm incredibly skeptical, and for the same reasons I was in 2024.

Pretty small price to pay so far, for the peace of mind of owning my own PDS :)

My PDS recently broke because bsky.app added a x-atproto-session-id CORS header :) That's probably my fault, but Claude was pretty good at spotting that! It also found a security vulnerability :)

The joys of running your own PDS! Honestly, a lot less trouble than I was expecting :)

Fake news!

+1

Replying to

dame@dame.is

Bluesky networkPosted15d ago

imitation is not the sincerest form of flattery, credit and citation is

The natural selection forces in my household are:

- if you go in the dishwasher and break I won't buy you again
- if you go in the washer and dryer and you wrinkle or shrink you also won't live long enough to reproduce

This is the way.

A few other ones I'm agitating too:

github.com/w3c/tpac2026...
github.com/w3c/tpac2026...
and
github.com/w3c/tpac2026...

Yeah, that shows up in so much my work too ... for example, I'm pretty proud of how I got the progressive enhancement properties of email verificaiton:

developer.chrome.com/docs/identit...

We made FedCM backwards compatible with RPs and managed to redeploy hundreds of thousands of websites ...