> Registration like you propose opens up completely unauthenticated Sybil attacks I proposed no such thing. If it’s important to know which client made a parti

> Registration like you propose opens up completely unauthenticated Sybil attacks I proposed no such thing. If it’s important to know which client made a particular call, then it’s important to authenticate that client. An old school CD-key can provide a one time shared secret to bootstrap a client install, or even a PBKDF if matched with a serial number to securely share the client secret. Most implementations are concerned with AuthN and AuthZ for users and don’t require these extra controls for client security (i.e. you don’t care which client instance a user interacts with) I was responding to erroneous assertions that these controls couldn’t be implemented.