Very good point! I think @TheButtonJustSpins@infosec.pub has a good idea on how to circumvent that.

I could make my own database with hashed passwords using postgreqsl and RLS, which is pretty secure. The User then decrypts the hashed passwords once on login and is simultaneously logged into multiple instances of Lemmy to get the JWT of each instance, which is then stored in SessionStorage or even in a Cookie if the User wants to which would make this a one-time process.

On signup the User could just register to one instance and then I just generate random 32 Character passwords and hash them with the Users' password, then get the JWTs and if cookies are enabled the that would only have to be done every year or so (or when the User deletes the Cookies).

This whole process is seems pretty easy, especially if you've done something like this before and I'm betting some other App Dev is already taking notes lmao.

Edit: Let's also do a thought experiment on what data will be leaked if I did this 1:1 and the database gets somehow hacked:

For each User:

1. Username (=> Gives away that you use Nemmy)
2. Hashed Passwords (=> Hashed passwords cannot be read if you don't have the original Users' password until we have access to quantum computers which can literally crack the encryption algorithm)

Hopefully the app will make site-specific passwords?

To make sure you got your reminder, @remindme@mstdn.social in 3 hours

Beep boop bop, for some reason I got a reminder and you didn't, so here is your human-generated reminder:

3 hours have passed. The name of the app has since been posted: Nemmy

Yeah, you can visit the Alpha Webapp: nemmy.app and install it on your phone. Also, here's the Community for it: c/Nemmy.

Yeah, you can visit the Alpha Webapp nemmy.app and install it on your phone. Also, here's the Community for it: c/Nemmy.

Thanks for letting me know, I'm still new to Lemmy :).

What if users could just configure their own named groups for communities from the various instances, and when you view the group you'd see a feed from all of them?

Figuring out if two posts are identical is going to be a challenge

I think I could deal with duplicates pretty easily by checking if different properties of the post are identical, the more are the less likely it is that the post will be shown.

I think a bigger problem is the comments. What if a user reposts a post from r/astronomy on lemmy.world to c/astronomy on lemmy.ml? Which one do we show, and what do we do with the comments of the other? Merge them together, or just leave them? Maybe show a button on the post when there's a duplicate und the user can switch instances?

Lots of figuring out to do, but it sounds fun!

Edit: The Group-by-Hashtag thing is also a good idea! That would of course make the whole thing less of a headache, but to make that work a lot of users need to do that.

Yes, from what I've seen there are a some people who are concerned about others impersonating them on other instances.

Yeah, it's a web app. I route all requests through my own backend, so it's server-server communication between Nemmy and any Lemmy instance, circumventing CORS by design.

Are you sure the CORS settings are messed up? I tried reaching the API a couple of times from my frontend for debugging and got errors due to authentication security. Are you referring to that or something else?