Developer Take on: Who Owns Your ATProto Identity? Hint: It's Probably Not You
Introduction
As we delve deeper into the realm of modern software development, we find ourselves becoming increasingly accustomed to services and frameworks that simplify our workflow. One such tool is ATProto, a robust, open-source framework that makes it effortless to build serverless applications. However, amidst the elegance of ATProto lies a crucial oversight – a lack of transparency regarding ownership of identities created within the framework. This article will delve into the world of ATProto identities and uncover the surprising truth behind who actually owns these identities.
ATProto Identities: An Exploratory Overview
In the context of ATProto, identities are crucial components that enable authentication, authorization, and other security-related mechanisms within your serverless applications. These identities are often created and manipulated directly within the framework, without any apparent awareness of who owns them. As developers, we assume that since we're creating these identities to facilitate our application's functionality, we must be the owners of these identities. Unfortunately, nothing could be further from the truth.
The Problem with Default Identity Providers
By default, ATProto applications utilize an internal identity provider that generates and manages user identities within the framework. This internal provider is often referred to as the "in-memory identity provider." It's the default choice for many ATProto projects, primarily because of its ease of implementation and configuration. However, what most developers are oblivious to is that this internal provider is actually a separate entity from their application, created and owned by the ATProto Framework. This distinction raises essential questions regarding data ownership, access, and control when your application relies heavily on these managed identities.
To illustrate this, consider a simple ATProto application that uses the atproto library to create a user identity. Here's an example main.ts file that demonstrates this:
import { Server, Client, Id, Identity } from '@atproto/server'
import { createApp } from '@atproto/server'
import { init, createClient } from '@atproto/client'
import { inMemoryIdprov } from '@atproto/idprov/in-memory'
async function main() {
const { server, client } = await createApp({
idprov: inMemoryIdprov,
// Other configuration and middleware
})
// Create a new user identity
const identity = await client.createIdentity({
name: 'exampleUser',
})
console.log(identity)
return { server, client }
}
main()
In this example, we create a new user identity using the createIdentity function provided by the atproto/client module. This newly created identity is owned by the internal in-memory identity provider, which is a part of the ATProto framework.
The Dark Truth: ATProto's Identity Provider is the Owner
As we've established that the internal identity provider is separate from our application, it brings us to an unsettling realization – ATProto's internal identity provider is responsible for all identities created within our application. This reality is rooted in the framework's design, where the identity provider acts as a centralized authority for identity management. This centralization of control is exactly what makes this issue more problematic, as any issues or security concerns related to these identities will ultimately fall under ATProto's responsibility.
While ATProto's ownership of these identities is an unsettling revelation, it's essential to note that this is not unique to the ATProto framework. Many other frameworks and services also utilize internal identity providers that may not entirely align with the interests of their users (your applications and their users). This raises crucial questions regarding identity ownership, accountability, and control.
Recommendations for Transparency and Security
To mitigate the issue of identity ownership, developers should familiarize themselves with their framework's internal policies and practices regarding identity management. Here are several key takeaways:
- Use an external identity provider when possible: When you have control over your identity infrastructure, consider utilizing a third-party identity provider like Google Auth or Auth0. This allows you to maintain ownership and control over your identities and associated credentials.
- Carefully review framework code and documentation: Familiarize yourself with the internal implementation of your framework's identity provider. This can help you identify potential areas for customizations or extensions that might align better with your application's needs and requirements.
- Implement custom identity management: In cases where you're unable to use an external provider or extend the framework's existing identity management features, consider implementing a custom identity management system that allows you to maintain ownership and control over your identities.
Conclusion
The issue of identity ownership within ATProto is an unsettling revelation that challenges our assumptions about our applications and their associated identities. As we continue to develop and innovate using powerful frameworks like ATProto, it's essential to recognize and understand the complex relationships between our applications, frameworks, and the underlying infrastructure they utilize. By gaining clarity on these relationships and exercising caution in our development practices, we can ensure the security, transparency, and accountability that underpin our applications and the identities they manage.
Resources
