These are some personal, raw and unfiltered mental notes I took from a series of discussion over the years.
One problem that we identified early on that we still don't know how to solve is the IdP Tracking Problem: wouldn't it be great if we could login to websites without necessarily telling the Social login provider that we did?
NOTE: I've been told numerous times that this is clearly not the case for R&E or enterprises, where this is a feature, not a bug, so trying to make it clear that I'm talking about Social login for consumers, rather than universities or enterprises
Since we started developing FedCM, I think a lot has changed. For one, we got a lot more experience with zero knowledge proofs. For two, the three-party model got more mature too, with credential formats like SD-JWTs and ISO MDocs being deployed in systems like government-issued IDs. Importantly, we also developed a much stronger foundation with FedCM that we can stand on (e.g. we know how to construct a privacy preserving account chooser, log-in users that are logged-out, etc), making this problem a lot more tractable now than it was a few years ago.
I'm interested in ZKP formats most, but since MDocs and SD-JWTs might be bit easier to start from. I think zero-knowledge proof formats, such as BBS+, can increase the privacy properties here, and be supported in a similar architecture.
It is not yet clear to me what kinds of trade-offs this architecture will have, but I have an intuition that it will offer a very different set of properties compared to other alternatives. For example, this is clearly backwards incompatible with the existing server-side deployment, so will activate the ecosystem much more slowly than vanilla FedCM. But, on the other hand, I think that this is likely the most private cross-site identity system that we can build, because it involves the fewest entities possible, so will find its use in enough places.
One problem that we identified early on that we still don't know how to solve is the IdP Tracking Problem: wouldn't it be great if we could login to websites without necessarily telling the Social login provider that we did?
Since we started developing FedCM, I think a lot has changed. For one, we got a lot more experience with zero knowledge proofs. For two, the three-party model got more mature too, with credential formats like SD-JWTs and ISO MDocs being deployed in systems like government-issued IDs. Importantly, we also developed a much stronger foundation with FedCM that we can stand on (e.g. we know how to construct a privacy preserving account chooser, log-in users that are logged-out, etc), making this problem a lot more tractable now than it was a few years ago.
I'm interested in ZKP formats most, but since MDocs and SD-JWTs might be bit easier to start from. I think zero-knowledge proof formats, such as BBS+, can increase the privacy properties here, and be supported in a similar architecture.
It is not yet clear to me what kinds of trade-offs this architecture will have, but I have an intuition that it will offer a very different set of properties compared to other alternatives. For example, this is clearly backwards incompatible with the existing server-side deployment, so will activate the ecosystem much more slowly than vanilla FedCM. But, on the other hand, I think that this is likely the most private cross-site identity system that we can build, because it involves the fewest entities possible, so will find its use in enough places.