ATProto gives your PDS operator full control of your signing and rotation keys, letting them impersonate you across every app in the ecosystem or kill
Your identity isn't your username
Your handle is a label; your identity is a key you own. atproto splits who you are from what you're called, so you can rename freely, prove who you are with a domain you control, and carry one identity across the apps you use. Part of 'Apps as Views, Not Vaults': the things you make are yours; apps are just the viewers.
Entryway operator guide — running atproto-entryway
Operating atproto-entryway: the account service and OAuth authorization server in front of one or more PDS instances. What it owns, keys, pairing a member PDS, the full environment reference, reconciliation, and the traps.
I Was Right About ATProto Key Management - nora's notes
Note: this post has been revised to be split into two sections: a description of what happened, and my analysis. I hope to make it clear that, while I do not like ATProto in general, I am trying to make good-faith critcisms of specific design decisions and outcomes, and in fact, this post getting updoots on HackerNews appears to have gotten the attention of the team, so, mission accomplished. ref, ref My account has since been manually reinstated; this has not happened for any of the other users that have had this issue, as far as I know.
Registering Identity Recovery Keys via PDS, using goat | bryan newbold
One of the big design goals for atproto is for users to "own their network identity". If something goes wrong with a hosting provider, it should be possible recover accounts by independently updating their identity to point at a new home. Every account in the network has both a handle and a DID. Th...
@me - explore your atproto identity
visualize your decentralized identity and see what apps have stored data in your Personal Data Server
@me - explore your atproto identity
visualize your decentralized identity and see what apps have stored data in your Personal Data Server
@me - explore your atproto identity
see your atmosphere account — one account, all your apps and data
your app can run its own pds - keith.is
if you’re building on atproto, you’ve probably reached for “sign in with bluesky” as your auth story. it works! the OAuth flow is fine. but every time a user shows up without a bluesky account, you have to send them to bluesky first, watch them get confused by a totally different brand, and hope they come back. that’s a weird seam in your own product.
scottlanoue.com/atmosphere-credential-provider
Experimental Android credential provider for atproto accounts
the single most important part of atproto is the PDS as a user-controlled auth and storage layer to which clients can connect directly. death to appviews
Authenticated Transfer Enables Orchestration - nekomimi
blog.nekomimi.petthis is kinda another reason im starting to think more and more that there would be worth in splitting atprotos identity layer out as its own spec and standard. building up handles and oauth around a DID makes for a really flexible cross platform (and potentially cross ecosystem) identity system
Nelind
i kinda hate how atproto adopting DIDs has made people intrinsically associate DIDs with atproto ... it makes some people see me as some annoying bitch trying to shove atproto into places it obviously doesnt belong in when i suggest using DIDs as user identifiers for other systems
if you’re using Bluesky OAuth in your app, change your metadata filepath to /oauth-client-metadata.json to have just your brand domain show up on the authorize screen rather than a suspicious looking url string i think 90% of atproto apps don’t do this, seems to not be documented yet
ollie thanks mozz 🫶
(sorry for driveby but i think tangled can update the file to be at path `/oauth-client-metadata.json` to get rid of that long display name *disappears*)
This seems like a crucial questions about what "data ownership" means for atproto. If the 3rd party doctrine applies, as Mike suggests, then I'm not sure it's possible to claim ownership unless it's self-hosted or it doesn't apply to your PDS host. Something to watch when permissioned data lands.
Tynan is afk til 10/19 ⁂
@masnick.com I’m listening to your interview with @reckless.bsky.social. This third party doctrine is interesting. Do you think that atproto data would be considered properly owned by the account individual? Would be interesting implications if that public data fall under search and seizure rights.
An underappreciated #atproto feature is that whenever apps want to update your data: 1. they ask your PDS for permission, 2. your PDS asks you, 3. you can say no, + 4. your PDS enforces your wishes As of today, the @tranquil.farm PDS UX lets you give "partial no" answers to question 3. Bravo!
Trezy
This is awesome. I made a PR last week to add better support and display for permission-sets to the OAuth consent screen for @tranquil.farm. Now every time I log in to my Atmosphere account, I can actually see my fingerprints on Tranquil. 😍 #atproto
