Re: [apps-discuss] I-D Action: draft-ietf-appsawg-acct-uri-05.txt

["Markus Lanthaler" <[e-mail]>]

On Monday, July 01, 2013 9:10 PM, Peter Saint-Andre wrote:
> >> However, a date could be included in an API or protocol that enables
> >> applications to use 'acct' URIs. Is there a reason why this would
> >> need to be included in the URI itself?
> >
> > Sure.. but I think the date should actually be a (perhaps optional) part
> > of the identifier, i.e., the acct URI. That would also make it easier to
> > exchange it between various applications and protocols.
> 
> Are you arguing that it would be easier or *safer*?

Well, both I think. It would make it simpler to exchange such information in
an interoperable manner and the resulting systems would be safer.


> Also, it seems that your argument would apply to URIs in general (e.g.,
> HTTP URIs for web pages) and not just 'acct' URIs. However, we seem to

That's true and AFAIK there have been efforts to do such things there as
well. Now of course we can't change HTTP URIs but since acct is just about
to be established we still have a chance to "fix" it there.


> have ways to deal with stale/old HTTP URIs and the like. Thus I wonder
> what in your mind is special about 'acct' URIs in this respect.

It is specifically designed to denote a user account on some system.
Consequently it is highly security sensitive. We've seen the problem with
recycled email accounts that have been used for user identification. Again,
email is really old and we can't change it anymore. We have, however, still
the chance to improve the situation for acct and I think it would be
worthwhile to do so.



--
Markus Lanthaler
@markuslanthaler