[Microid] MicroID hashing algorithm(s) and normalization

eran at yedda.com eran at yedda.com
Sat Dec 9 05:24:52 EST 2006


On 12/9/06, Chris Roos <chrisjroos at gmail.com> wrote:

> I agree, because there is no way to stop spoofing of microids.  I
> think spidering could be used to provide clues as to what you may have
> authored, but not to decide that you definitely are the author.  I
> wonder if spidering becomes more of an option if you've already
> verified a link with a given site, and, a third party (me or a
> verifier) trusts that the site doesn't allow microid injection from
> the outside (i.e. the site is responsible for generating all microids
> in its pages).  This would give me some trust in spidering the site
> and finding all content relating to you.  As a practical example, I
> might want to aggregate all of the reviews I've written on amazon.
> Assuming amazon doesn't offer this already, and that they don't allow
> arbitrary microids to be inserted, I could use an aggregator to spider
> amazon looking for all reviews with my microid.

The major point here is not spoofing or not spoofing. They can spoof all they want to. Only a site of the likes of claimid.com is where my identity should be proven (which is the OpenID/whatever part of the story that I'm not going to cover here).

Only what I claim is mine, therefore, let them spoof whatever they want. If I don't claim it, I don't stand behind it.

> I understand this point but can't think of anytime I'd want to do
> this.  Maybe you could give an explicit example?  The argument also
> only holds up when talking about each page having its own microid.
> What if one page has multiple microids (e.g. a forum) - if it contains
> a message from each of your identities then they will still both have
> the same microid.

Even in a forum each post has a permalink, this means that even multiple posts that I have are actually different resources (or sub resources, if you wish) inside the page. Since the hashing is on the complete URL (including its anchor, which is the usual way permalinks work for elements in the same page) each of my posts will have a different microid.

It is true that in the case of a forum I might want to claim the whole disscussion (although technically, this is a discussion and not all of it, as opposed to blog post minus the comments, is mine). 

We can probably think of a solution on how to implement this, for example:
a) Have a microid near my profile part (which is usually in each post - at least the name) which contains the URL of the discussion and the my email/openid/whatever. This will allow me to claim the whole page (although sometimes you will want to claim specific posts)

b) Have a microid near each permalink (including the anchor, of course) so I will be able to claim a specific post on the thread.


This point actually leads me to something that I think will be essential in the spec (or as an addundum).
I think that we must specify implementation samples (in the forms of text, not code) on where and how  one should implement microid in various scenarios (blog, forum, etc). Perhaps this is a good place for a wiki where we can add additional scenarios as we find them.

Eran




More information about the Microid mailing list