5 ms·
They still need to defend against malicious requests; for example how do you know that it's not someone's potential enemy requesting for that information?
by toxicFork 8y ago
They still need to defend against malicious requests; for example how do you know that it's not someone's potential enemy requesting for that information?
- Rjevski 8y agoBut unless they had your ID before, how can they tell it’s the ID of the account owner and not a homonym? Also how would they defend against fake IDs? If the purpose is to prevent malicious access then they better expect that attackers will try and use fakes.
- a_imho 8y agoThey need to resort to the mechanism agreed upfront to prove identity. Usernames, emails, numbers + passwords, keys etc. At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases. However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.