<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Johannes Ernst wrote:
<blockquote cite="mid4AF1E5BB-B0F3-4D80-BD32-CB0F0894690B@netmesh.us"
type="cite">
<pre wrap="">On May 14, 2007, at 9:12, Dick Hardt wrote:
</pre>
<blockquote type="cite">
<pre wrap="">The issue you bring up is a separate issue then the motivation for
recycling identifiers by large OPs.
</pre>
</blockquote>
<pre wrap=""><!---->
What I'm saying is a superset of the issue discussed so far that
ought to use the same technical solution because the problem is the
same: "X used identifier Y, and now Z controls Y. What now?"
</pre>
<blockquote type="cite">
<pre wrap="">Your point is how does a user transfer from one identifier to another.
</pre>
</blockquote>
<pre wrap=""><!---->
While related, that's not the issue I was talking about.
But you are right in that all of those problems should be solved at
the same time.
</pre>
<blockquote type="cite">
<pre wrap="">The issue at hand is the scarcity of namespace.
-- Dick
</pre>
</blockquote>
</blockquote>
Absolutely. :)<br>
<br>
Can some of these issues be solved via best practices? For example:<br>
<br>
RP:<br>
1. If you ever get a 410 Gone response from identifier Y, immediately
decouple X from Y -- mark account as inactive at least.<br>
2. Try to ping known accounts for 410's at least once a year. If you
see one, go to step #1.<br>
3. If no ping, and no login from Y for over a year, treat account as
inactive when Y attempts to log in again.<br>
4. Inactive accounts require out of band procedures for recovering data
or transferring to a new OpenID identifier (equivalent to password
reset).<br>
<br>
And on the provider side:<br>
OP:<br>
1. When you deactivate an account, make the OpenID return 410 Gone for
a minimum of two years.<br>
2. Notify customers that they must transfer or shut down all services
using the identifier before the de-activation.<br>
3. Recycle identifiers only after the full two year period has elapsed.<br>
<br>
Also, we may want to consider:<br>
RP:<br>
1. When you see a 301 Permanently Moved response for Y, follow it and
update your local identifier keys.(*)<br>
<br>
OP:<br>
1. When a customer wants to transfer identifiers, use a 301 Permanently
Moved response for the old identifier for a minimum of one year.<br>
2. After one year, respond with 410 Permanently Gone for a minimum of
one year.<br>
<br>
These are straw men, feel free to knock them down.<br>
<br>
(*) May conflict with other forces, such as SEO. <br>
<br>
<br>
<div class="moz-signature">-- <br>
<a href="http://feeds.feedburner.com/aol/SzHO"><img
src="cid:part1.09040801.05070408@aol.net"
style="border: 0pt none ; float: right;" alt="Abstractioneer"></a>John
Panzer<br>
System Architect<br>
<a class="moz-txt-link-freetext" href="http://abstractioneer.org">http://abstractioneer.org</a><br>
</div>
</body>
</html>