How to handle re-used identities

[larry]

@vsund

But Blockstack IDs can expire and another user can pick it up (which could get even a bigger problem with crawlers etc).

The way Blockstack Auth currently works, is that it provides the calling application with a unique decentralized identifier. (DID) This identifier is a bitcoin address.

It can optionally provide a verified Blockstack ID.

@vsund

Therefore the question raises what should happen with the linked data and I’d like to kick off a discussion about this.

What happens with user data when someone picks up my ID after I forgot to renew it (or when I intentionally don’t renew it)?
Should services delete my data when I revoke my ID?
Do I lose my all my account data when I forget to renew my ID?
Is it the duty of the service that uses Blockstack Auth to handle this accordingly?

One way to solve this problems is to have a unique identifier tied to the lifecycle of a name. The identifier is created when the name is registered and follows the name through transfers to different addresses until it is revoked or perhaps transferred with a special command that indicates it is changing ownership.

@ryan and I came up with one possible way to handle this.

@ryan

“blockstack key”:<bitcoin-address>:<name-index>

…where the “name index” translates to an index in the list of keys ever owned by this address.

Here’s how it should be interpreted:

If the name index (N) is “-1” or absent:The signing/authentication address is equal to the bitcoin address.

If the name index (N) is >= 0:
The name is the Nth name ever owned by the address.
Walk the name transfer operations of the name. Stop if you see a delete operation. The final address that currently owns the name is the signing/authentication address.

I’d love to hear your thoughts @vsund