Reddit no longer verifying #67

This issue was first opened here: keyoxide/keyoxide-web#192

Reddit claims are indeed no longer verifying. It appears Reddit is taking measures to ban scrapers: keyoxide/keyoxide-web#192 (comment)

Need to do more research. Just as with Twitter, we could try and use oembed to perform the verification.

Indeed, oembed is a viable strategy. Here's my existing proof fetched through ombed: https://www.reddit.com/oembed?url=https://www.reddit.com/user/YarmoM/comments/hhd318/openpgp_proof/

--edit It is viable, but requires the proof to be part of the title, since the post content is not included in the oembed data

After some testing, here are a few notes:

• The original (.json) API does support CORS and thus would function in a typical browser environment
  • Example (I opened DevTools on a codeberg tab to ensure CORS was processed):
    image
  • However, unless it would be different inside of keyoxide, Firefox's "Tracking Protection" seems to falsely flag the API as a tracker, meaning it may be unusable in the browser for most firefox users
• The oembed API does indeed only show the title, and also does not support CORS (though that is a net zero in terms of requests, as the original verification method is marked as NOCORS regardless)

In terms of Reddit there are a few routes we could take:

1. moving request to the client to prevent rate limiting (but risking clashes with tracking protection 😕)
2. downgrade to oEmbed
3. using PushShift/PullPush
4. copy redlib's approach of generating guest OAuth tokens

Personally, I would take the redlib route of mimicking Reddit's Android app as they do here: github.com/redlib-org/redlib@99097da6b8/src/oauth.rs and if that ends up being prevented fall back to oEmbed.

Linking https://community.keyoxide.org/d/317-cant-verify-reddit for cross-visibility

Is it possible to change the message from "The claim COULD NOT BE verified by the proof." to something like "Claim verification currently not possible." and maybe some kind of orange icon instead of the red cross mark?

This way it doesn't directly look like it is a failed verification. People could still manually verify.

I have this issue (or a similar issue?) as well.
Keyoxide profile: https://keyoxide.org/aspe%3Akeyoxide.org%3ABW4JHVBB5HM3DMAVNSY34QAEQU
Proof link: https://www.reddit.com/user/GideonBear/comments/1mz1mny/proof/
Discussion on Matrix: https://matrix.to/#/!dEfJkFpQpwvbzcegRX:matrix.org/$iHAsFGijvf4CIoyvHEPrACtEgfstBw9VApqgc1q7n6M?via=matrix.org&via=tedomum.net