It refers to the property of FedCM that means nothing about your account is revealed to the website until you click the "Continue As" button. In other words, alternatives to this that use third-party cookies enable tracking you between websites without any user interaction.
It isn't exclusive to MCP, it applies to any regular OAuth connection between apps under the same enterprise IdP too, but MCP is a topical example at the moment.
(a list of things that are specifically bad implementations)
In my demos the OAuth flow completes so fast you can't even tell it happened, you don't even see the address bar change to the IdP the second time you do a flow when you already have a session there.
Exactly. Even in a relatively dense location, I have a new automation that runs when my cameras detect a person, both blaring a siren outside as well as notifying me in the house. Now about half a dozen times, it has stopped someone from getting farther than a few feet on the property, whereas without it I had people sneaking around looking for unlocked doors.
Check out the actual spec, there's nothing in IndieAuth that relies on third parties. The whole point is so you can authenticate as your own domain to other things. There are some helper services that let you authenticate via Twitter/GitHub in case your website doesn't support IndieAuth natively. https://indieauth.net
ActivityPub by definition doesn't work with a static site. But check out this project which offloads the ActivityPub parts for any site assuming you can make a request there as part of your static site build process https://fed.brid.gy/
> edit: Also, why doesn't webmention.io display its own mentions to utilize the two-way communication it advertises? Seems like a no-brainer to show prospective users an example of it working in action
This is a good idea, and if I were re-making this service new in 2021 I would definitely do this. However I launched this in 2012 as a barebones implementation to get webmentions working for a few of my websites and never bothered to develop it much past that point.
The good news is everyone who receives webmentions can decide what it looks like themselves! In fact you'll see quite a lot of variation in how these are displayed on people's websites. Everything from a list of comments, to just a list of URLs, to a grid of faces with no text!
eta: There is also no requirement that the receiver of a webmention displays it! You could just as well use it for private notifications of the links.
I'm having a different (but likely related) problem, which is that my SMTP stopped working today.
I have a legacy Google Apps account on a custom domain, and have had two-factor auth configured for years. Today my SMTP credentials stopped working, so I went in and made a new app-specific password, and that is also not working as my SMTP password. I also can't enable the "less secure apps" option because 2fa is enabled. I don't see any path to fix this.