I think new models and progress will have to be based on looking at the technologies available, such as cryptography and web protocols, and figuring out what ar

I think new models and progress will have to be based on looking at the technologies available, such as cryptography and web protocols, and figuring out what are the best and most convenient systems you can assemble for various levels of security. For instance, a site can track your visits with a cookie, without your creating an account, as long as you use the same browser and the cookie doesn't expire. Cookies seem like almost enough for a lot of scenarios, except that you can't (currently) transfer them to a different browser and there's no standard way to distinguish the person that owns a cookie if multiple people use the same browser.