<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Martin Atkins wrote:
<blockquote cite="mid4644AD2B.9050401@degeneration.co.uk" type="cite">
<pre wrap="">John Panzer wrote:
</pre>
<blockquote type="cite">
<pre wrap="">And believe me, AOL is very concerned about recycling and the issues
therein. We of course have a globally unique identifier that's used
internally in exactly the way described above; this lets you
disambiguate whether example.org/fred is the same fred as last year or a
new fred. For policy reasons we can't expose that GUID, but perhaps a
hash(GUID,RP identifier) would be perfectly fine to expose in a standard
"permaGUID" attribute.
Yes, this doesn't help with disambiguating things like authors of blog
posts in archives. But there datestamps are usually available.
</pre>
</blockquote>
<pre wrap=""><!---->
An identifier plus a timestamp alone don't really help you much, because
you probably don't know at what point in time the identifier ceased to
be one person and started to be another.
This problem is really in two halves, with different needs each:
A) HTTP URLs for authentication. This is to do with preventing a
subsequent identifier owner from accessing data created by prior owners.
B) HTTP URLs for identification. This is to do with figuring out who
actually did something given only an OpenID identifier as attribution.
</pre>
</blockquote>
In many cases, you also have a time context. Almost everything
published on the web and other places has at least a simple timestamp
on it: Blog posts, web pages, events, log entries... In a large and
interesting subset of the problem space, you can make a 99% accurate
inference that <a class="moz-txt-link-freetext" href="http://bob.com/">http://bob.com/</a> on May 15, 2007 is almost certainly the
same person as <a class="moz-txt-link-freetext" href="http://bob.com/">http://bob.com/</a> on May 17, 2007. If you have some best
practices that put a known buffer between recyclings (1 month, 1 year,
whatever) you can improve this accuracy. And of course if you control
the data you can always add a timestamp. (If you don't control it,
perhaps you can't achieve 100% accuracy anyway.) <br>
<br>
In other word, I disagree with the premise that there's not enough
information to achieve a reasonable approximation of B, as long as we
restrict B to trying to answer "do identifiers X at time0 and X at
time1 denote the same identity?".<br>
<br>
I don't see another way to solve this other than by adding a GUID to
the identifier-as-published-on-the-web (or at least a revision number)
which is, in a word, ugly. Also no less prone to social engineering
attacks IMHO.<br>
<br>
-John<br>
</body>
</html>