Re: "confirm subscribe" use case for "secret URI"

Larry, 

this also brings up a simpler case: confirmation of valid email address.
If the URI is ever resolved, it means the email address where the URI
was sent is read by someone or something. In other words, the email
address is valid enough. 

On the other hand, are the URIs in these cases really secret? It feels
like your point (b) goes against a requirement for secrecy.

Best regards,
Jacek Kopecky


On Thu, 2010-02-11 at 14:07 -0800, Larry Masinter wrote:
> the link to confirm subscription is:
> 
>  (a) one-time 
>  (b) accidental disclosure does not have a serious impact
>      and recoverable (can unsubscribe)
>  (c) misuse can be audited (web site, presumably, maintains
>      log of IP address of requester)
> 
> 
> So this is a positive use case for a "secret URI".
> 
> Larry
> --
> http://larry.masinter.net
> 
> 
> -----Original Message-----
> From: forum@unicode.org [mailto:forum@unicode.org] 
> Sent: Thursday, February 11, 2010 2:03 PM
> To: Larry Masinter
> Subject: Welcome to "The Unicode Consortium Discussion Forum"
> 
> Welcome to The Unicode Consortium Discussion Forum forums
> 
> Please keep this e-mail for your records. Your account information is as
> follows:
> 
> ----------------------------
> Username: masinter
> 
> Board URL: http://www.unicode.org/forum
> ----------------------------
> 
> Please visit the following link in order to activate your account:
> 
> http://www.unicode.org/forum/ucp.php?mode=activate&u=84&k=421T7N4NND 
> 
> Your password has been securely stored in our database and cannot be
> retrieved. In the event that it is forgotten, you will be able to reset it
> using the email address associated with your account.
> 
> Thank you for registering.
> 
> --
>

Received on Sunday, 14 February 2010 10:28:40 UTC