Re: [ogpx] A Review of Multi-Domain Use Cases [Was: Re: OpenID and OGP : beginning the discussion ...]

[Carlo Wood <[e-mail]>]

On Tue, Jun 30, 2009 at 08:03:28AM +0100, Morgaine wrote:
>  1. Arbitrary in-world name tags, which have only one intent: to provide a
>     customer-satisfying visual name.
>  2. Globally unique identifiers, either UUID or formed by composition of N-part
>     local name @ issuing authority.
>  3. Entirely separate authentication credentials, in other words, unrelated to
>     1) or 2).
> 
> Keeping these 3 things entirely disjoint would serve us well in many ways,
> particularly in the key areas of scalability, flexibility, uniqueness, and
> user-friendliness / appropriateness.
> 
> Morgaine.

While I also totally agree-- I think there is something missing there.
The authentication credentials will be 'constant', of course, but the
way the above is formulated, it could very well be possible that 2) is
not constant (A new UUID could be generated every login).

However, it is necessary that 2) is sent to all the viewers that come
into contact with an agent and in order to be able to recognize/verify
that agent automatically as having been seen before, and not being
an imposter, or even to just be sure you can append to the correct
log file (for example), 2) has to be the same every login.

Therefore, I'd like to propose this:

 1. Arbitrary in-world name tags, which have only one intent: to provide a
    customer-satisfying visual name.
 2. Globally unique identifiers, either UUID or formed by composition of N-part
    local name @ issuing authority, that remain the same over logins for any
    given account and that are passed to every viewer that receives 1).
 3. Entirely separate authentication credentials, in other words, unrelated to
    1) or 2).


-- 
Carlo Wood <[e-mail]>