They need to resort to the mechanism agreed upfront to prove identity. Usernames, emails, numbers + passwords, keys etc. At this point I see this practice most

They need to resort to the mechanism agreed upfront to prove identity. Usernames, emails, numbers + passwords, keys etc. At this point I see this practice mostly as deterrance with a little cya mixed in, possibly with a pinch of data fishing in some rare cases. However in the future I'm all for providing IDs as a requirement to use webservices if that makes people more conscious about what data they share.