GoKawiilThe login screen of any web application is the equivalent of that application telling you “In order to access YOUR data in MY database, prove you are who you say you are.” You’re authenticating with the application so that you can have the privilege of giving it your data.
In a previous blog post, I covered the downside to applications controlling your data. An application’s owner can restrict your access to your own data. They can delete the data. They can sell the data to a third party. They might introduce a bug that allows other people to access the data. They might get compromised. Or they can avoid all of this just to modify their policies down the road or see changes in ownership or management.
In a word: poppycock. It’s your data! You shouldn’t have to prove to anyone else that you have the right to access it. No one should tell you how to use your own data. And no one should do anything with your data that you aren’t comfortable with.
To gain agency over your data, you have to have agency over the database in which it lives. If you own the database, you actually own the data. But running a database is a serious undertaking that we can’t expect from the average internet user. And even if you run a personal database, how should applications interact with it?
Over the past few months, I’ve explored the concept of personal database authorization, which allows you to give an application access to a database you control. Specifically, I built an authorization flow into ayb, my project to make it easy to create databases, share them with collaborators, and query them from anywhere. Here’s a video of how you can grant an application access to a freshly created database you own. Critically, the application has no login screen, instead asking for a database where your data will live:
Authorization in action: A to-do application with no login screen that requests access to a database you control. Todos is the to-do list application I created and use as my daily driver.
Holding on to your data
Here are three principles behind what’s happening in the video:
... continue reading