[sldev] OpenID & SSL certificates

[Argent Stonecutter]

On 30-Sep-2007, at 17:53, Tao Takashi wrote:
> Well, this is maybe more a question of how good the controls in SL  
> are to protect
> your privacy (and I am not sure the once done enhancement to  
> visibility etc. is
> really an enhancement to me. I need more a chance to switch it off  
> completely
> instead of a by-person basis).

There's two separate issues here.

First, SL has basically no in-world privacy controls. And it's not  
because they couldn't be implemented... they have nothing to do with  
new architecture or old architecture or anything else. And I'm not  
even talking about phantom zones or private parcels... even something  
as simple as being able to log on in-world without showing up on the  
IM-style interface isn't there, and what *is* there is a feature  
that's basically impossible to use if you have more than a few  
entries in your friends list. So there's little indication that they  
really consider improving privacy worth spending effort on.

Second, I wasn't even thinking of it as a privacy issue. I'd love  
real privacy in SL, but all I'm talking about here is what it takes  
to get the ability to do the real-world equivalent of going out in  
public.

> If we look at the new SL architecture where agent and identity are  
> more
> separate concepts it should be possible to group your alts together  
> under
> one identity.

The reason I brought up grouping here is not because I need it now,  
or because it's something I'm actively interested in, but because IF  
they go to a scheme like this we WILL need it. It would be a  
mitigating factor.

The fact is, though, they haven't done it even at the billing level,  
or even given you any way to identify your alts as being alts of the  
same character except by whatever ad-hoc guesses they use internally,  
and they don't give you any way to know what they have set up. I  
mean, I used different email addresses so I can get mail for  
different accounts to go to different mailboxes to help me sort it  
out. Then they came out and said that we weren't supposed to do  
that... so I brought them back together. But the experience doesn't  
give me any good feelings that they'd actually take advantage of any  
new architecture in a way that helps us..

> Thus you login via OpenID and choose which agent/avatar to
> use. This might enable also inventory handling between alts in a  
> better way.
> I see the problem here more in the SL implementation instead of  
> choosing the
> right authentication mechanism.

I'm not disagreeing, I'm just looking at it with the assumption that  
they're not going to implement it, and thus we will have to do  
something with third-party clients to at least restore the status quo.

> As said, this depends on the implementation. If agent and identity
> are separate things then it could be grouped. But this should be  
> possible with
> every authentication used, even the existing one right now.

We don't *need* grouping at the client with the current  
implementation, because we can *ignore* who the SL website thinks is  
logged in, and just log directly in to SL. Grouping at the billing  
level should be independent of the agent information, but that's all  
hidden.

> As OpenID relies (I think) on some redirection magic between  
> provider and
> client this of course only works on the web. The existing SL splash  
> screen is
> a web enabled already though and it should be possible to implement  
> it that way.
> But I guess it's not very practical to use this as browser for all  
> sorts of different
> ID providers.

Not to mention that I still can't get the splash screen without  
punching a hole in my proxy firewall because they don't have any  
proxy support.

> If this certificate is attached though then you'd need to use the  
> web once for
> linking the OpenID account to that certificate which in turn is  
> given to the client.

It sounds like your saying that OpenID would make it impossible to  
create a version of the client that restored the status quo if LL  
went ahead and used it for the original proposal.

> I know though that having all those accounts on the web gets a bit  
> annoying

I would rather have lots of accounts, one for each service, than one  
that doesn't give me the flexibility to NOT link my identity at one  
site to my identity at another site without going through a lot of work.

OpenID could provide some nice facilities, I'm sure, but unless the  
default model makes them happen automatically laziness will lead to a  
situation where maintaining separate IDs for different sites is  
unworkably difficult.