[Microid] microid on OIDD
Will Norris
will at willnorris.com
Wed Mar 14 12:08:37 EST 2007
The beauty of microid is that I set the microid on my page once and
leave it there so that I can use it to verify my ownership of the
page on any number of third party services. For example, you have a
constant microid on solution-media.de with a value of
"8860d6cf2db6ae58d7488d55faa93446abc20aa7". If I knew what email
address was used to generate that ID, I could have my OpenID provider
send over that email address for me and I would be able to claim
ownership of that site. While you certainly *can* edit the microid
on your site anytime you want, you shouldn't have to go and edit your
site source code every time you want to claim ownership at a new
third-party.
MicroID doesn't specifically say anything about verifying email,
because that is somewhat out of scope. MicroID is a spec for
designating that a particular principal owns a particular piece of
content. I can use a known identifier for a person to verify if they
own any particular piece of content which contains a microid.
Someone can claim that they are thomas.huhn at gmail.com, and I can use
that identifier to verify that "thomas.huhn at gmail.com" owns a
particular piece of content, but that still doesn't verify that the
person actually *is* "thomas.huhn at gmail.com". If you are consuming
microids in this manner, it's a fundamental principal that you need
to verify the identity you are using actually belongs to the user you
are verifying for. With OpenID this is automatic, but if you're
using email then additional verification is necessary.
(I apologize if my language isn't clear on this... I'm trying to type
this in the middle of a meeting, so I can try explaining better later
if necessary. Additionally, I'm going to CC the microid list to see
if someone there can clarify. Are you on that list?)
-will
On Mar 14, 2007, at 9:34 AM, Thomas Huhn wrote:
> I think you´re missing the point that you have to have the
> possibility to
> change the sourcecode of the page you claim to be your own. I didn
> ´t find
> anything about having to verify an email adress in the MicroID specs.
>
> The point is: the verification works only for the moment you
> verify. You can
> change ANYTHING later on - you can change your email, delete the
> MicroID on
> your site etc. You can even connect this website to another OpenID
> and email
> as long as you have the correct (new) MicroID on your site. It´s
> similar to
> the Wordpress MicroID plugin: you can change your email adress ever
> after
> and create a new MicroID.
>
> At least as long as you´re using Meta Tags I don´t see a
> possibility to fake
> the ownership of a site. Maybe the buttons could open a security hole
> (forums that allow html e.g.), but the owner of a site can get the
> control
> back at any time.
>
> Don´t you agree on that?
>
> -Thomas
>
> 2007/3/14, Will Norris <will at willnorris.com>:
>>
>> Since email is not verified, but rather just asserted, I don't think
>> you can use it. If I want to claim a site that I don't actually own,
>> all I have to know is the email address of the actual owner and have
>> my OpenID provider send that email address. If you had the user
>> verify their asserted mail address by sending them some link, then
>> that would work, but as it is the only thing that is actually
>> verified is the OpenID itself.
>>
>> -will
>>
>>
>> On Mar 14, 2007, at 8:36 AM, Thomas Huhn wrote:
>>
>> > Hi Will,
>> >
>> > thanks for pointing me to this issue and pushing me to a better
>> > solution
>> > :-). You´re absolutely right - this "special implementation" was a
>> > quick
>> > shot and not well thought.
>> >
>> > I´ve fixed this and you will find that everything is conform to the
>> > standards of microid.org now.
>> >
>> > You have a new field for the LinkID which pulls the website URI out
>> > of the
>> > database and the email from your login. These two parameters now
>> > form the
>> > MicroID.
>> > I do use email as one of the URIs because I want to force the
>> > possibility to
>> > send feedback. I know this is somewhat prohibitive because the
>> > users IdP
>> > needs to support SREG, but as there are enough free OpenID
>> > providers out
>> > there this shouldn´t be too much a limitation.
>> >
>> > The verification process is fully automated now. If you still
>> have any
>> > problems or suggestions, please drop me a line.
>> >
>> > Thomas
>> >
>> > BTW, I updatet
>> > http://blog.openiddirectory.com/2007/03/12/gaining-control-over-
>> > your-link-descriptions/
>> >
>> > 2007/3/14, Will Norris < will at willnorris.com>:
>> >>
>> >> I was looking at the new OIDD today and trying to figure out
>> how to
>> >> claim ownership of my Wordpress plugin in the directory. I found
>> >> your blog entry that discussed it and read the "Promote Your
>> Votes"
>> >> page, and now I'm feeling quite confident your use of microid is a
>> >> bit "off". A few red flags for me:
>> >>
>> >> - the promote page uses a custom meta name "oidd-microid"
>> instead
>> >> of the name specified in the spec, simply "microid"
>> >> - the promote page is not asking for the page that I'm claiming
>> >> before generating the microid. This immediately tells me
>> something
>> >> is wrong, since that should be the second half of the ID. I tried
>> >> several combinations of things, and was unable to actually
>> generate
>> >> the microid that page has, so I can't figure out what URIs you are
>> >> using.
>> >>
>> >> What two URIs are you using?
>> >>
>> >> -will
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2448 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/microid/attachments/20070314/3fba5772/attachment.bin
More information about the Microid
mailing list