<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Mr. Shade,<div><br></div><div>I still believe deregistration of the user is beneficial to alleviate the other problems I mentioned resulting from stale identity information. However, as you describe, in the event that site A is compromised or malicious, all is indeed lost unless the user is able to manually reconcile themselves at all their RP's. That's generally a pretty unfortunate situation that should be avoided actively.</div><div><br></div><div>Yet another reason I think OP reputation and communities are really important,</div><div>Nate.</div><div><br><div><div>On 30 May 2008, at 23:34, SitG Admin wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">I don't think there's any way to do that, *period*. If site A wants to say something about the user (as identified by their URI), it can. If it wants to collect details about the user, it can add that data to the mix. If the user *cooperates* (say, by volunteering their personal information because the program/service/game "requires" that to function, or to inform them of updates, or whatever), it can add that data to the mix. Most importantly, though - if site A wants to, it can *make up* information about the user and report this to anyone that asks.</font></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px; font: 12.0px Helvetica; min-height: 14.0px"><br></p> <p style="margin: 0.0px 0.0px 0.0px 0.0px"><font face="Helvetica" size="3" style="font: 12.0px Helvetica">The *real* trick is in getting anyone else to *trust* what site A says. As noted in Peter's message, RP's that decide "Well, the user *used to* trust site A - last time we checked, anyway." to override "The user is telling us NOW that they do NOT trust site A." aren't following the security protocols. We can address this trust issue in the specs (I thought it was already?), and laws against libel may be applicable in making the site stop "saying" it (at least, so outspokenly), but I don't think there's any way of making a site *remove* data/details about someone. (A lot of royally pissed-off trolls whose various identities were exposed and the proof posted on the internet, can attest to this through their inability to have that evidence removed.)</font></p> </blockquote></div><br></div></body></html>