Tuesday, June 20, 2006

Ownership claim mechanisms

A post on the Identity Trail, and my recent experiments with ClaimID's verification mechanism made me think about the general question of "How do I convince somebody that some online resource is mine"?
  • By having the resource in my 'possession' (and the RP having some expectation that such possession is restricted)
  • By making a modification (at the behest of the RP) to the resource
  • By demonstrating my ability to control access to the resource
  • By demonstrating knowledge of some secret associated with the resource
  • By having a trusted 3rd party (or lots of somewhat trusted 3rd parties?) assert to my ownership of the resource
  • By responding to a challenge message sent to the address of the resource
I'm sure there are others.

Related but different, which of the above mechanisms would serve to convince that an identity resource is 'about' me? The second, third and last options would appear to be excluded.

No comments: