Email addresses are not good 'permanent' identifiers for accounts

Re:Email addresses are not good 'permanent' identifiers for ... by brewmarche on Sunday December 31, 2023 @09:51AM (#38824418)

OIDC actually already handles this by requiring the `sub` claim to never be re-assigned and unique: https://openid.net/specs/openid-connect-core-1_0.html#IDToke...

Of course this means that an ID token should not contain an e-mail address under `sub`.

[ Parent | on HN ]

Re:Email addresses are not good 'permanent' identifiers for ... by fauigerzigerk on Sunday December 31, 2023 @10:39AM (#38824751)

So the identity provider could just generate this unchangable ID and let the user link any number of aliases to it, right?

[ Parent | on HN ]

Re:Email addresses are not good 'permanent' identifiers for ... by uxp8u61q on Sunday December 31, 2023 @12:21PM (#38825633)

That is what TFA suggests, yes.

[ Parent | on HN ]