feoblog icon indicating copy to clipboard operation
feoblog copied to clipboard

UserID revocation

Open NfNitLoop opened this issue 5 years ago • 0 comments

When a UserID becomes compromised, or a user just wants to delete their account, they should be able to create a revocation Item. Servers should honor this item by:

  • Refusing to accept any new items for that user.
  • Refusing to serve any existing Items for that user (except the revocation Item itself).

The server should also delete the content for that user, but may do so asynchronously. (ex: via a clean command at some later time.) This could allow someone whose key has been compromised a chance to recover their content and publish it under a new key.

  • The /u/:userID/proto3 endpoint should list 1 Item, which is the revocation item, so that other servers that sync from this one will learn of the revocation.

There's a TODO here: https://github.com/NfNitLoop/feoblog/blob/develop/protobufs/feoblog.proto#L114 ... but the more I think about it, the more I think a Revocation should be its own item_type. I don't want the option of specifying a Profile.display_name, about, servers, or follows.

NfNitLoop avatar Jan 21 '21 02:01 NfNitLoop