Re: [ogpx] A Review of Multi-Domain Use Cases [Was: Re: OpenID and OGP : beginning the discussion ...]

[Carlo Wood <[e-mail]>]

On Mon, Jun 29, 2009 at 06:11:21PM +0200, Carlo Wood wrote:
> If this is the case, then I'm happy and there should be no problems
> in the future regarding this. If no separate ID is provided then
> several problems occur:
> * Impersonation (people deliberately using the same shape and skin etc)
> * IM's will be logged to the same file, because the viewer can't
>   know who is who.
> 
> Also, the ID has to be same every time - because the viewer will
> need to recognize that this John Smith is not AGAIN a new one,
> but the same, every time.

To clarify; what started this thread was this:

    & identifier = {
        type: 'agent',
        first_name: string,
        last_name: string,
    }

Here I only see 'first_name' and 'last_name'.
As we've established now (I hope) this is not enough at
any level of the protocol, not between servers, but also
not between server and client.

Hence, it worried me. If you say "identifier" I expect
something globally unique.

I think this should be:

    & identifier = {
        type: 'agent',
 	uuid: string,
        first_name: string,
        last_name: string,
    }

Where the uuid is not only unique, but constant for any given
account (it doesn't change if one logs out and logs in again).
It could be an email address, but for privacy reasons I think
that should not be used; some hash seems much more logical.

-- 
Carlo Wood <[e-mail]>