- By having the resource in my 'possession' (and the RP having some expectation that such possession is restricted)
- By making a modification (at the behest of the RP) to the resource
- By demonstrating my ability to control access to the resource
- By demonstrating knowledge of some secret associated with the resource
- By having a trusted 3rd party (or lots of somewhat trusted 3rd parties?) assert to my ownership of the resource
- By responding to a challenge message sent to the address of the resource
Related but different, which of the above mechanisms would serve to convince that an identity resource is 'about' me? The second, third and last options would appear to be excluded.
No comments:
Post a Comment