Re: [ogpx] A Review of Multi-Domain Use Cases [Was: Re: OpenID and OGP : beginning the discussion ...]

[Infinity Linden <[e-mail]>]

okay. cool. i see where you're going with this.

right. as a developer or a region domain, you want to depend on
something more globally unique than first name + last name, otherwise
you risk John Jones from example.com and John Jones from example.org
getting confused with each other. in the email case it's the human
who's the consumer of this name so the human can apply all sorts of
contextual pattern matching and fuzzy reasoning to try to figure out
if the two might be the same. but it would be imperative we have a way
to avoid REQUIRING region domain software from applying a list of
similar heuristics.

so yeah. a global identifier of some sort is good. it does not need to
be an email address, but it will have some of the same
characteristics: part of it will unambiguously identify the authority
(i.e. the FQDN of the agent domain host that holds info about the
agent) and the other half holds the identifier that is unique inside
that domain. i would vote we use a URI; they have these
characteristics, and they're not an email address that can be spammed.

but at the end of the day if you want distant systems to be able to
reference individual agents, you would need a way to address them, and
unless you wanted to REQUIRE a white list you have to admit the
possibility that a malicious adversary might try to force the protocol
or spam you.

i also don't think having two John Jones rezzed in the same region at
the same time is _that_ big of a problem, provided the region domain
and the client application have enough information to disambiguate the
two if it is required.

On Mon, Jun 29, 2009 at 9:11 AM, Carlo Wood<[e-mail]> wrote:
> On Mon, Jun 29, 2009 at 07:51:09AM -0700, Meadhbh Siobhan wrote:
>> the second one is left as an exercise to client application developers
>> and is analogous to the difficulty end users may have in
>> differentiating two entities with the same name but distinct email
>> addresses.
>
> Well, then I'm almost satisfied :).
>
> There is still one problem however. Before the application developers
> can do this, they need to receive some globally unique identifier
> that is always the same (ie, an email address, but again, I REALLY
> don't want to share my email address with people online).
>
> Example, a viewer is connected and the corresponding agent resides
> in a given region. There it meet another avatar. In order to display
> the tag above this new avatar the viewer needs to receive Firstname
> Lastname... but, as I've tried to argue so far, it ALSO needs to
> receive a globally unique identifier that uniquely identifies the
> person behind the avatar (or rather, his account) and please don't
> let it be an email address ;).
>
> The point being: the server-client *protocol* needs to be designed
> such that this globally unique ID is made available to all viewers.
>
> If this is the case, then I'm happy and there should be no problems
> in the future regarding this. If no separate ID is provided then
> several problems occur:
> * Impersonation (people deliberately using the same shape and skin etc)
> * IM's will be logged to the same file, because the viewer can't
>  know who is who.
>
> Also, the ID has to be same every time - because the viewer will
> need to recognize that this John Smith is not AGAIN a new one,
> but the same, every time.
>
> --
> Carlo Wood <[e-mail]>
>