Authorize, Don't Authenticate
5 hours ago
- The author argues for an 'authorize, don't authenticate' model where users grant applications access to their own personal databases rather than logging into centralized apps.
- Applications should store minimal data outside the user's database, allowing users to revoke access at any time and maintain control over their data.
- Creating personal databases should be as simple as creating a document, with tools like ayb making it easy for non-technical users.
- Separating applications from databases offers user choice in data hosting and reduces reliance on single application providers, though trust is transferred to database hosts.
- Collaborative and social data require more complex models, but the author envisions decentralized aggregation without centralized controllers.
- The author's projects (ayb, Todos) demonstrate practical implementation using OAuth2 and static frontends, enabling user data agency.