Verify that a given FAH username belongs to a given person

[api]

I want my website to verify that a given FAH username belongs to a given person (which only makes sense if they have a passkey). How do I do this without asking them to send the passkey? Is there API for this?

[PaulTV]

I'm not quite sure if I understand what you wanna reach. But technically, a FAH username does not per se belong to a single person, anyone can use any name. That's probably one of the reasons the passkey was introduced, which should be confidential. Some real-live persons use different passkeys with the same username for different computers, to help separating results/statistics per computer.

If you look at https://apps.foldingathome.org/bonus, and enter a username, you'll see one entry for each passkey that is used for that username, but of course you won't see which real-live person is behind what entry.

[Neil-B]

Welcome to the forums api ... FAH usernames do not belong to anyone ... FAH passkeys are issued to folders via an email address that they have access to (and are linked to that email address) to allow them to identify their donations of resource and are intended to be private keys ... Acquiring someone's passkey in any manner makes the passkey meaningless and defeats the purpose of their existence ... I am unaware of anyrequirement within FAHs processes that would necessitate a username to be validated to a given person - indeed to try and do so might be a breach of privacy laws in numerous legal jurisdictions ... I am aware that some folders may choose to share their passkey with various non FAH reward schemes to allow them to benefit from those but that is their choice ... I must admit to being a little concerned writing this response to an enquiry from a new effectively anonymous/unverified/validated forum account asking how to personally identify folders using an api call without asking the folders permission in any way.

[gunnarre]

Some "reward" schemes create the usernames that they want the folder to use themselves and request that the work is credited to the scheme's own team - so that's one way you might avoid people claiming other people's past work as their own. There is, however, no way to prevent other people from later crediting work to that username.

Sharing of passkeys should not be done.

Beyond that, this forum doesn't really provide support any of these third-party reward schemes - be they for cryptocurrency, giftcards or whatever - so please find support for this elsewhere. (They're not supported, nor prohibited, by the Folding@Home project - just off topic for this support forum.)

[api]

Welcome to the forums api ... FAH usernames do not belong to anyone ... FAH passkeys are issued to folders via an email address that they have access to (and are linked to that email address) to allow them to identify their donations of resource and are intended to be private keys ... Acquiring someone's passkey in any manner makes the passkey meaningless and defeats the purpose of their existence ... I am unaware of anyrequirement within FAHs processes that would necessitate a username to be validated to a given person - indeed to try and do so might be a breach of privacy laws in numerous legal jurisdictions ... I am aware that some folders may choose to share their passkey with various non FAH reward schemes to allow them to benefit from those but that is their choice ... I must admit to being a little concerned writing this response to an enquiry from a new effectively anonymous/unverified/validated forum account asking how to personally identify folders using an api call without asking the folders permission in any way.

I did not intend to do it without permission. I just need to verify when a person comes and claims to have earned this many points on FAH that they did indeed earn those points.

[api]

Some "reward" schemes create the usernames that they want the folder to use themselves and request that the work is credited to the scheme's own team - so that's one way you might avoid people claiming other people's past work as their own. There is, however, no way to prevent other people from later crediting work to that username.

Sharing of passkeys should not be done.

Beyond that, this forum doesn't really provide support any of these third-party reward schemes - be they for cryptocurrency, giftcards or whatever - so please find support for this elsewhere. (They're not supported, nor prohibited, by the Folding@Home project - just off topic for this support forum.)

I understand that sharing of passkeys should not be done however there are many OAuth providers that achieve a similar goal securely. I think it is on topic to ask whether an OAuth-like protocol can be emulated using the available FAH functionality. I am not asking anything about any third party reward schemes.

[PaulTV]

The basic answer is: a user can't claim a user name and can't claim to be a particular user. Most reward schemes don't award based on previous results. They require users to fold for a specific team, and only reward on results that are returned for that team.

Say, I have been folding for a while already, and already have collected 100M points. But I want to get Cure Coin for my folding efforts. That requires me to fold for the Curecoin team (amongst other things, like registering the username on the Cure Coin site). I would not get rewarded for all the work I did previously, only for new jobs returned for that team.

Of course, someone else could use the same name as I do for returning results. I may not like that (it'd 'contaminate' my results on for example Extreme Overclocking), but I can't prevent it. The only that you can do to reduce the chance of someone using the same user name is using an uncommon name, and checking if the name is already in use before returning a job.

I've read questions like 'can I move points to a different team or user for previous jobs'. The answer is: no you can't. Once a job is returned for a particular user/passkey/team, that's final and can't be changed.

[PaulTV]

I understand that sharing of passkeys should not be done however there are many OAuth providers that achieve a similar goal securely. I think it is on topic to ask whether an OAuth-like protocol can be emulated using the available FAH functionality. I am not asking anything about any third party reward schemes.

OAuth relies on a user name (or mail address) being unique. FAH user names are not. If a FAH user name has to be unique, it would not be possible to simply install a client and have it running without further configuration (the default user name is Anonymous). I don't know if making it possible to claim a unique user name is on the roadmap, but I seriously doubt it, given limited resources and other more urgent subjects on the to-do list.

[aetch]

You don't need a username to fold.
When we started folding we all started as "Anonymous".
If you look at the leader boards you'll see that "Anonymous" is still the biggest contributor.
The usernames are merely for our own benefit to keep tarck of what we are individually contributing.
There's nothing to stop a group of people from contributing under the same username.
At the end of the day the work itself is checked and verified, specifically who did it is a bit less important.

Personally, I use the extremeoverclocking.com website to keep track of my own contribution.
Something that I had noticed that there was sometimes a discrepancy between a contributors ranking on extremeoverclocing.com and FAH own stats.
I finally figured it out a few weeks ago.
The exported stats list each username along with the team it's contributing to, if I had joined 3 teams (after leaving the default team 0) I would be listed 4 times in the exported stats. "extremeoverclocking.com" treats each user/team entry as a separate user. FAH collates them all under a single user listing the contribution to each team.

[Neil-B]

I just need to verify when a person comes and claims to have earned this many points on FAH that they did indeed earn those points.

I do not believe this is possible with the way FAH points work at this time ... and I doubt it will be possible in the future tbh.