EdGraVill / ssa

Self Signed Authentication

SSA or How to keep our personal information for real

SSA (Self Signed Authentication) is a standard way to let users keep their information out of the internet and, at the same time, allow apps to request access to certain information and authenticate it.

Example of implementation

Get know permissions

ssa.initialize(/* A way to safety identify the app */);

...

const permissions = await ssa.getPermissionList();

// [] or ['user.name.first', 'user.name.family', 'user.avatar.picture', 'app.uuid']

if (!permissions.length) {
  return <LoginPage />;
}

if (!permissions.includes('app.uuid')) {

}

return <App />;

Request permissions

const permissions = await ssa.requestPermissionList([
  'user.name.first',
  'user.name.family',
  'user.avatar.picture',
  'app.uuid',
]);

Display user's information locally

const [firstName, isFirstNameFetching] = ssa.getDataHook('user.name.first', 'utf8'); // Or should be ssa.useGetData or ssa.useGetDataHook
const [profilePicture, setProfilePicture] = useState('');

useEffect(() => {
  ssa.getData('user.avatar.picture', 'binary').then((bin) => {
    const blob = new Blob(bin, { type: 'image/*' });
    const url = URL.createObjectURL(blob);
    setProfilePicture(url);
  });
}, []);

if (isFirstNameFetching || !profilePicture) {
  return <User.Loading />;
}

return (
  <User>
    <ProfilePicture src={profilePicture} />
    <User.Name>
      <User.FirstName>{firstName}</User.FirstName>
      <User.LastName>
        <Suspense fallback={<User.NameLoading />}>
          {ssa.getDataLazy('user.name.family')}
        </Suspense>
      </User.LastName>
    </User.Name>
  </User>
)

The .ssa file

The encrypted file that stores all the user's data, including permissions and the information itself.

Ideally shold be a text file, but since the idea is store binary, I still don't know.

If the file keeps as plain text can looks like: (Storing JSON parsed)

Profile1,Profile2,My Name

#Profile1
{
  "user": {
    "name": {
      "first": {
        "allow": ["app1", "app2"],
        "value": "Foo"
      }
    },
    "avatar": {
      "picture": {
        "allow": ["app1", "app2"],
        "value": BIN??? IDK. Or maybe ref to a file??
      }
    }
  },
  "apps": [
    {
      "id": "app1",
      "uuid": "75573283-cd21-4499-ba3f-e607306ce7a8",
      "data": {
        "foo": {
          "value": 42
        },
        "bar": ['baz']
      }
    },
    {
      "id": "app2",
      "uuid": "fcfeb62e-e567-4de9-859d-0a200e92dd05",
      "data": {
        "baz": {
          "value": 42
        },
        "foo": ['bar']
      }
    }
  ]
}

#Profile2
...

#My Name
...

Ideas

• Store the information locally
• Website will use an API to request the information to that local file
• Of course, sites can identify a user with an Id, but that Id will be generated in the .ssa file and will be unique per application
• Instead of requesting the personal information from a closed DB, it will request that from the .ssa file
• Companies own the product, the presentation, even the data that the users generate by using the product, but the personal information has to be owned by the user
• Should be able to store data generated by the product, and the product can access that data without restrictions, but the user can erase that data

Questions to resolve

• How to encrypt the information separated so if the file has been leaked can't access the information
• How to keep the user safe from fake information request
• How to allow users to allow an app
• How to expose to others like in a chat. An approach could be an information transporter
• How to share between devices
• How to request permissions to write information, for example, to register the user for the first time
• How to prevent websites maliciously storing the user's already given information. Almost impossible tbh, but we can certify apps that use ssa properly
• How to request fill new information