Currently we think of the atmosphere as a set of interconnected apps but the user experience is lots of logging in to different pieces. Additionally we know that people don’t understand this idea of “log in with your atmosphere account”
As more services roll out signup it’s going to be more important to stress that the account you use for bsky, mu.social, etc. is the same account as the one we’re asking for.
I put up a Proposal and PR in the ATStore repo (Atmosphere login by chris-pardy · Pull Request #54 · ATProtocol-Community/ATStore · GitHub)
The important thing is that this doesn’t try to do anything with a shared login, rather it’s just a hint for the login prompt.
There is an issue of tracking. Every site that opts into using this on external links sends a consistent DID in the query parameter. This means that that did can be tracked across many sites. I don’t think this is any more pervasive than existing tracking code but I don’t want to introduce something people aren’t comfortable with.
This scheme is tricky in terms of (GDPR-)compliant UX. It would require clear consent before forwarding the identification to the other app, or alternatively a “use as …” button (but that maybe could be “use as (avatar)” for short, not sure!).
In the “use as …” case, there could/should in my opinion be much more clear direct login intent semantics (with any necessary ToS and privacy policy agreement as part of the flow).
I don’t know if there are better alternatives. You could pass a redirect URL and friendly name instead that the target app then offers to pass its login redirect URL to (“log in via …”) to rebound to the PDS, but that could open up avenues for phishing.
Interesting on the GDPR angle. Maybe having each app publish a “login url” that could take a did. That would mean that that from atstore you could click “login” to go straight into the app.
All the other ways of doing this require some sort of central clearinghouse - this is the same problem with the atmosphere login button.
1 Like