2 ms·

So, an email address? Unless that is the point you are making of course (as I type this I realise how slow I might be being!). Alternately if they want to stic

So, an email address? Unless that is the point you are making of course (as I type this I realise how slow I might be being!). Alternately if they want to stick to the domain structure: user.domain.tld (I've not checked to see if that is already supported). The problem with both of those though is that you are then less in control of your identity – the domain owner has the power to stuff you over if you are just a user of it. Because of this issue for you as the user, it means that the identity is not as trustworthy to the service because the domain owner can take control of it themselves or reassign it.

stanleydrew 4y ago
> The problem with both of those though is that you are then less in control of your identity – the domain owner has the power to stuff you over if you are just a user of it. I don't think this is true. When you control the domain then you control email and subdomain address spaces. In the context of the given example, there's no difference in control between dholms.xyz and dan@dholms.xyz or dan.dholms.xyz when the same person registered or created all of them.
- dspillett 4y ago
  > when the same person registered or created all of them Exactly. How does the service trusting that the address or subdomain as identity know that they refer to the person that created them? I have surname.tld, I create dave@surname.tld for me and wayne@surname.tld for my brother. If Wayne annoyed me and I was a dick about it I could revoke the name or reconfigure it in order to act in his name maliciously. The same for sub-domains. How does a service wanting to trust the address as ID know which of us has that control? My identity is more strongly linked to my token (address/sub-domain) than Wayne's but there is no way to infer this from the identifying tokens themselves. Of course a hack at domain registrar level could stiff it all over, so even only using top-level domains isn't perfect, but there is definitely a difference in the level of identity stability guarantee between domain and sub-domain or email address. (So the is a difference between dholms.xyz, and dan@dholms.xyz or dan.dholms.xyz)

stanleydrew 4y ago

> The problem with both of those though is that you are then less in control of your identity – the domain owner has the power to stuff you over if you are just a user of it. I don't think this is true. When you control the domain then you control email and subdomain address spaces. In the context of the given example, there's no difference in control between dholms.xyz and dan@dholms.xyz or dan.dholms.xyz when the same person registered or created all of them.

dspillett 4y ago
> when the same person registered or created all of them Exactly. How does the service trusting that the address or subdomain as identity know that they refer to the person that created them? I have surname.tld, I create dave@surname.tld for me and wayne@surname.tld for my brother. If Wayne annoyed me and I was a dick about it I could revoke the name or reconfigure it in order to act in his name maliciously. The same for sub-domains. How does a service wanting to trust the address as ID know which of us has that control? My identity is more strongly linked to my token (address/sub-domain) than Wayne's but there is no way to infer this from the identifying tokens themselves. Of course a hack at domain registrar level could stiff it all over, so even only using top-level domains isn't perfect, but there is definitely a difference in the level of identity stability guarantee between domain and sub-domain or email address. (So the is a difference between dholms.xyz, and dan@dholms.xyz or dan.dholms.xyz)