I find this news disconcerting coming from such a large instance so early on. Many of the criticisms of Lemmy I’ve been fighting against on Reddit have had to do with defederation and the possibility of getting cut off from your favorite communities on your main account. I handwaved that away as being extremely unlikely save for the exception of NSFW or extreme political content. But this news has taken me quite by surprise. Perhaps I should have seen it coming given the community Beehaw is trying to foster.
This really makes me wonder what will happen to instances that make this decision. Will their communities diminish in favor of the more accessible ones? Will this decision hurt Beehaw in the long run? What does this mean for the Fediverse in the near future when fighting against its detractors has been such an uphill battle?
Thoughts?
I wonder how separating logins from instances would work from a programming standpoint. People’s accounts need to be hosted on servers somewhere, so it raises some really interesting questions when the topic of defederation and drama like this comes up. For example, the Beehaw admins are running a server somewhere. If we decouple accounts from instances, then my assumption is that we’re randomly assigning accounts to servers. So that leads to the possibility of the Beehaw admins hosting an avowed fascist on their server by the design of Lemmy as a whole. I’m sure they would probably take issue with that. Beyond that, who has the control to ban spam/abusive/illegal accounts from the platform as a whole? If someone is going around posting child porn or something else illegal, surely we need to have a way to remove them from all of Lemmy. If it’s the server owner where the account was assigned then that raises some really weird questions about their control.
Another theoretical structure for this would be having two types of servers - user servers and community servers. Then users can still choose their server admin, but it would be divorced from any restrictions a community server puts up against other servers. But then what happens when an avowed fascist creates their own user server and won’t ban troubling accounts? Then that raises questions of whether a community can ban a user server, which kind of brings us back to square one…
We almost had decentralized logins with OpenID. I remember the push. It started seeing more widespread usage in the spaces I visited at the time, and even Google is/was an OpenID provider. Facebook and their “Login with Facebook” nonsense took things backwards when other vendors wanted to be a
data trackerlogin provider, also.With the ban evasion scenario you mentioned, having something like OpenID would give you an immutable ID number that can be used anywhere. Bans and blocks would go according to that ID, and evasion would require a new account. I think that would be a good middle ground for data privacy. It does make law enforcement’s job harder, though. Which does take us back to square one when it comes to removal of content, especially illegal content.
I am actually reaching the end of my knowledge on the subject in the following, so if anything after this is flat-out wrong with the technologies listed, I’d love some corrections.
If we go purely theoretical with existing tools, a blockchain would ideally assign those unique IDs. That’s a username and account creation date. GPG to sign each request (the second factor), and the entered password with the signature would decrypt an encrypted blob on IPFS with the requested information, similar to how Storj DCS stores data in encrypted buckets. Enter the wrong password, you get an empty bucket. Password recovery becomes an issue at that point, but one really should be using a password manager, passphrase, or hardware key these days, anyway.
Or use it as a feature and increase overall privacy by using a different password for each unique data blob shared with a service you’re authenticating with. It won’t matter, because your ID won’t change. For law enforcement, that does make things exponentially more difficult, maybe if you store the successful login attempts on the blockchain with the metadata that they claim to obtain from companies, it might work? There does have to be a balance between transparency and privacy.
A blockchain does seem like overkill for that, though. Having a unique Username might be good enough, since you don’t really want to have multiple users with the same display name anyway. Otherwise, things might start getting a bit confusing, especially if they’re both in the same instance.
Feels like a simple method would be a login provider that is related to the government. The gov have the best way to identify you and prove that you are who you are. That’s how you would get one unique ID that cannot be evaded by simply creating a new account.
Although, if you get banned from a community, there would be no way to get back in it because your gov id would be banned. Maybe the ban appeal could be more official instead of a letter to a random mod and hope you get an answer, hell, why not judiciarice the whole ban appeal thing so that you do have real recourse if you ever get banned for no good reason, a bit like when you get fired from a job.
Food for thought…
Although you end up having new issues with trying to sync up the user accounts across the list, and username conflicts, never mind a small server possibly having to keep up with a big list of users. Lemmy already has issues where the registration process will silently fail if the name you’re trying to register isn’t available, with no more indication than a throbber that just sits there and spins forever.
Maybe something like how Lemmy does communities? A user can first register from a server, but the account gets shuffled around if they join another community.