Shared account and unified user experience between different Discourse instances

[fokx]

Now we’ve seen so many projects/companies use Discourse as a discussion forum. However, I often find it a little cumbersome to register accounts for each website (though SSO alleviate this pain a bit) and setup user profile and preferences or something alike.

I wonder, like opting in for ‘Discourse Discovery’, could we add an option for site owners to opt in sharing account info with CDCK? Basically it could mean adding an SSO option like ‘Login with Discourse’. Moreover, to integrate more tightly, we can share user info and preferences between different communities like what Reddit does. It could be even better if users can access their aggregated activities/bookmarks/likes/replies data in one place.

Also, could common js /css / fonts assets be shared between different instances to accelerate first-time landing?

[michaeld (Michael - Communiteq)]

That is “privacy hell”, any Discourse instance would get access to all user names and email addresses of any other Discourse instance. And possibly even more. So that will never be acceptable.

[JammyDodger]

I think this feature was mentioned here too:

@mcwumbly

@simon

I’m not sure if it would be at odds with the idea of promoting the decentralized internet, but it might be worth looking into having the site function as an auth provider

I think providing more centralized services that add value is worth considering. An auth provider that removes the toil of setting up social logins is something that continues to come up from time to time and is very much on the table.

We just need to be mindful to do so in a way that avoids them becoming strict dependencies so sites continue to have the freedom to operate completely on their own in a way that is fully supported by the community.

[simon]

@JammyDodger

I think this feature was mentioned here too:

Sort of, but I was only thinking of Discourse functioning as an optional OAuth provider. Maybe it’s a slippery slope.

[pmusaraj (Penar Musaraj)]

@michaeld

That is “privacy hell”, any Discourse instance would get access to all user names and email addresses of any other Discourse instance.

Not necessarily. A future “Login with Discourse” service could operate like other social logins (Google, Apple, Facebook, etc.). Just because those logins are enabled, it doesn’t mean that the instance get access to all user names and email addresses at the source. The associated accounts will only be created for users that signup/login using that method.

The request in the OP is something that we have been considering for a while, it’s an interesting option that would reduce the barrier to joining a new Discourse community. But it’s a big, big project, and so far, we have hesitated to embark on it. Certainly an idea that comes up regularly internally.

[michaeld (Michael - Communiteq)]

@pmusaraj

@michaeld

That is “privacy hell”, any Discourse instance would get access to all user names and email addresses of any other Discourse instance.

Not necessarily. A future “Login with Discourse” service could operate like other social logins (Google, Apple, Facebook, etc.)

Those are privacy hell…

[awesomerobot (Kris)]

@michaeld

Those are privacy hell…

Those companies specifically have some privacy issues, but they also do a lot more than centralized auth.

I think there’s probably an argument to be made that centralized auth comes with its own risks, but the original claim you made is not accurate and not really relevant to that aspect:

@michaeld

any Discourse instance would get access to all user names and email addresses of any other Discourse instance

[michaeld (Michael - Communiteq)]

@awesomerobot

the original claim you made is not accurate

I stand corrected.

Regardless, I think this will very hard to be GDPR compliant.

[eisammy (Dreadwhole)]

Discourse Auth providing data hashes to start sessions multi-instance but we just trusting discourse to keep ours hashes safe is a dilemma to decentralized foruns.

Lemmy did something like that but with ActivityPub and all we knows that it’s a nightmare.