2015/Edinburgh/private
Security, Private Posts & Access Control was a session at IndieWebCamp Edinburgh 2015.
Notes archived from: https://etherpad.indieweb.org/private
Participants
- ... add yourself if you were here!
Notes
Private posts and access control
How to replicate livejournal experience, with public vs. friends only vs. only you. (River) Access control groups. Current social networks do this: circles etc.
Some people are making posts that are marked as only for certain people to see.
Issues:
- How to list the people who are able to see them? Currently people doing this by domain. The person who the post is for would have to log into the post's website in order to see it. They would have to look at each post indivdiually.
How to make this work with a feed?
Your reader could be a page on your own site. Your site authorizes with the sites that being pulled from and displays what you're allowed to see.
Also: how to make a post available to your facebook friend, or twitter followers? (People without indieweb sites).
River: would also like to mark up specific parts of posts with access control, so you can have a sanitized public version, and then a different version for authorized people.
How to stop people from passing private information on? Marking up bits of the page to say which parts are public and which parts are only available to the person seeing it.
How to do it with static sites?
Encrypt posts? People can know they're there but not read them unless they can decrypt them. openpgp.js
River: have a group of URLs of people allowed to see a post, when you post to them you discover their PGP keys from their sites, encrypt the post for those keys and post it. For each silo you'd need to use their own access control mechanisms. But people can see who you're encrypting for.
Ways to implement private posts:
- Private / capability URLs
- Server does access control
- Encrypt posts and (maybe) let everyone see them
Possibly you want a combination of these.
Private group sizes / types:
- Basically everyone who logs in / is not a bot
- 1000s - cf. facebook "friends"
- 10s of actual friends
Does pgp or similar scale to 1000s? Ok for case 3.
Maybe "static" sites can do access control, by using the web server authorization mechanisms.
What level of security is expected / required? Do we trust tls CAs or only end-to-end encryption?
You might want to use private post types for events, for your own calendar.
Really when you start talking about events not just being public ones, it starts become a personal organiser / lifelogger thing. Really need think of it as a general purpose database which needs well designed authorization.