[Microid] MicroID hashing algorithm(s) and normalization
Chris Roos
chrisjroos at gmail.com
Sat Dec 9 04:45:42 EST 2006
On 12/7/06, Peter Saint-Andre <stpeter at jabber.org> wrote:
> Evan Prodromou wrote:
> > On Wed, 2006-06-12 at 10:33 -0700, Peter Saint-Andre wrote:
> >
> >> But how do we know programmatically when we create the microid that a
> >> given URL is an OpenID?
> >
> > You mean, how do we know that the first string that we're putting into
> > the hash is an OpenID? Probably because the user said, "here is my
> > OpenID", and maybe they validated it using the OpenID protocol. Or maybe
> > we got it out of our database from the user_openid table.
> >
> > The big question is: why would we care what it is? As far as the microid
> > format is concerned, it's just a string.
> >
> > For the publisher of the resource, they can add a microid <meta> tag for
> > each ID they have for the user (email, OpenID, whatever).
>
> I agree. So why do this?
>
> ... content='openid:sha256:foo' ...
>
> If it's really opaque, why do we specify that it's an openid or an
> i-name or anything else? Just hand over the microid and the other end
> can figure out what it is (if it even cares, which I doubt).
Agreed. The verifier will already have to have an existing
relationship (email, openid or more that I can't think of - are there
any?) with the user. They can therefore just try each one in turn.
Chris
More information about the Microid
mailing list