Authorize, don’t authenticate

The login screen of any web application is the equivalent of that application telling you “In order to access YOUR data in MY database, prove you are who you say you are.” You’re authenticating with the application so that you can have the privilege of giving it your data. In a previous blog post, I covered the downside to applications controlling your data. An application’s owner can restrict your access to your own data. They can delete the data. They can sell the data to a third party. They might introduce a bug that allows other people to access the data. They might get compromised. Or they can avoid all of this just to modify their policies down the road or see changes in ownership or management. In a word: poppycock. It’s your data! You shouldn’t have to prove to anyone else that you have the right to access it. No one should tell you how to use your own data. And no one should do anything with your data that you aren’t comfortable with. To gain agency over your data, you have…