We are back to File->Open I guess. We could use native applications instead of web apps while we're at it.

Sadly this approach does not work for a lot of (web) apps.

Not sure this does anything for data portability, since apps will just store the data as encrypted & signed BLOBs.

1. How do you get around performance issues? If I have a difficult join and you have a slow database, or you have a flaky connection, how can I debug the problem on my end?

2. What stops me (or any attacker) from exploiting your lack of security? Are you 100% sure you are secure?

3. You mention collaboration - How does this work at a company level if we have many users and need to control access - the company is the entity with rights to the data in this case.

So many tools and libraries combine authorization and authentication, and it’s hard to find an authorization server that lets you outsource identity.

(All too often the underspecified abbreviation “auth” is used to cover both.)

Shameless plug: My colleagues and I implemented a minimal authorization server that lets you leverage a trusted identity provider of your choice (like Entra ID or even Auth0/Okta) and handle authorization. It looks up what roles and permissions the identified user should be able to have/grant and issues tokens containing that authorization.

https://github.com/DMGT-TECH/the-usher-server