Digital rights reviewer: understanding the criteria

[geeogi]

Hi there,

We at Zinc are keen to improve our understanding and implementation of Blockstack with respect to the user’s digital rights. I have a few questions regarding the criteria of the digital rights review. Hopefully this is the right place to ask. Many thanks in advance.

Blockstack auth

• Does the blockstack auth in our app need to be compatible with all browsers? If not, which ones?
• When Blockstack auth is offered as one of many options, what exactly differentiates between "secondary", "equal" and "primary" importance?

See PDF: Auth.Scoring.pdf

GAIA

• To score 4/4, must GAIA be the sole storage for all users? Or just for those who authenticate with Blockstack?
• To score 2/4, must GAIA be used for all users? Or just for those who authenticate with Blockstack?
• To score 2/4, can GAIA be used in a write-only manner on the app?

See: #79 (comment)

Feedback

• Is feedback offered on "broken" scores?

Feedback was given via comment in this thread: #60

[friedger]

referencing also #46

[xanbots]

@larrysalibra

[larrysalibra]

I've put together a doc with some quick sketches of how I think about authentication scoring:

Auth Scoring.pdf

Apologies for my drawing skills.

Re gaia, as mentioned in #58, going forward, we won't be treating apps that use gaia and in additional to 3rd party storage differently. There will only be 3 scores - uses gaia, doesn't use gaia or broken.

Our goal here is to reward developers that use gaia as a place to securely store the canonical copy of the data they generate using an an app and do it in a way where the developer never has access to encryption keys.

Initially, we're not going to be incredibly strict on this, but your best bet to be well-positioned for the future is to build your app in such a manner.

We'd like to see gaia used by all users regardless of how they sign in.

Hope that helps!

[jcnelson]

What happens if they use Blockstack Auth incorrectly? For example, by hard-coding a redirect to browser.blockstack.org instead of using the protocol handler?

[larrysalibra]

What happens if they use Blockstack Auth incorrectly? For example, by hard-coding a redirect to browser.blockstack.org instead of using the protocol handler?

Using Blockstack Auth incorrectly results in a broken score.

[stackatron]

Sounds like this is resolved. Moving to done.

[geeogi]

@jeffdomke yep. Thanks @larrysalibra for the clear and detailed answer 👍