[Microid] microid on OIDD

Will Norris will at willnorris.com
Wed Mar 14 14:07:53 EST 2007


On Mar 14, 2007, at 11:29 AM, Thomas Huhn wrote:

> Hi Will,
>
> thanks for clarifying some aspects, but I still have a couple of  
> questions
> ..
>
> 2007/3/14, Will Norris <will at willnorris.com>:
>>
>> The beauty of microid is that I set the microid on my page once and
>> leave it there so that I can use it to verify my ownership of the
>> page on any number of third party services.  For example, you have a
>> constant microid on solution-media.de with a value of
>> "8860d6cf2db6ae58d7488d55faa93446abc20aa7".  If I knew what email
>> address was used to generate that ID, I could have my OpenID provider
>> send over that email address for me and I would be able to claim
>> ownership of that site.
>>
>> While you certainly *can* edit the microid
>> on your site anytime you want, you shouldn't have to go and edit your
>> site source code every time you want to claim ownership at a new
>> third-party.
>>
>> MicroID doesn't specifically say anything about verifying email,
>> because that is somewhat out of scope.  MicroID is a spec for
>> designating that a particular principal owns a particular piece of
>> content.  I can use a known identifier for a person to verify if they
>> own any particular piece of content which contains a microid.
>> Someone can claim that they are thomas.huhn at gmail.com, and I can use
>> that identifier to verify that "thomas.huhn at gmail.com" owns a
>> particular piece of content, but that still doesn't verify that the
>> person actually *is* "thomas.huhn at gmail.com".  If you are consuming
>> microids in this manner, it's a fundamental principal that you need
>> to verify the identity you are using actually belongs to the user you
>> are verifying for.  With OpenID this is automatic, but if you're
>> using email then additional verification is necessary.
>
>
> Ok, I see. So you would propose to better use OpenID and the URI of  
> the
> website you claim as your own as the two URIs for the microid? Or  
> are there
> any other obstacles (besides not having a verified email adress for
> communication purposes) I´m not aware of at the moment?

well, the identifier you use as the first URI in the microid should  
be something that has been verified.  This is build-in for OpenIDs,  
so that would be the easiest.  If you do in fact want to ensure you  
have a valid email address, you can certainly use email, but you  
would need to verify ownership of that email address out-of-band  
(send them some email with a confirmation link they have to follow).

>> (I apologize if my language isn't clear on this... I'm trying to type
>> this in the middle of a meeting, so I can try explaining better later
>> if necessary.
>
> Thanks a lot for spending your time on me, I think I should have  
> better
> talked to you before implementing this. ;-).

no problem... I really like this stuff, so it's fun to work on.  And  
I don't know that you should have talked to *me* specifically about  
it... I'm certainly not the expert, but am willing to share what I do  
know.  The MicroID list would be the best place.


>> Additionally, I'm going to CC the microid list to see
>> if someone there can clarify.  Are you on that list?)
>
> Sorry, I´m not, but I´m gonna change this ;-).

probably a good idea... lots of smart people on this list :)

-will

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2448 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/microid/attachments/20070314/08603fb1/attachment.bin 


More information about the Microid mailing list