From: Seth Breidbart (sethb@panix.com)
Date: Sun Jan 21 2001 - 20:27:18 CST
My general feeling is that arbitrary tokens are better than IP
addresses (for all the reasons Brad gives); however, IP addresses do
have some advantages in combatting abuse. More important, however, is
the fact that IP addresses are the most common tokens now used, and I
wouldn't want to make existing software nonconformant for using them.
Hence, I'd support a statement that some sort of tokens (possibly IP
addresses) SHOULD be used, and a token that maps to the user/session
only via private information Ought to be used.
Seth