[Microid] microid on OIDD
Will Norris
will at willnorris.com
Wed Mar 14 14:07:53 EST 2007
On Mar 14, 2007, at 11:29 AM, Thomas Huhn wrote:
> Hi Will,
>
> thanks for clarifying some aspects, but I still have a couple of
> questions
> ..
>
> 2007/3/14, Will Norris <will at willnorris.com>:
>>
>> The beauty of microid is that I set the microid on my page once and
>> leave it there so that I can use it to verify my ownership of the
>> page on any number of third party services. For example, you have a
>> constant microid on solution-media.de with a value of
>> "8860d6cf2db6ae58d7488d55faa93446abc20aa7". If I knew what email
>> address was used to generate that ID, I could have my OpenID provider
>> send over that email address for me and I would be able to claim
>> ownership of that site.
>>
>> While you certainly *can* edit the microid
>> on your site anytime you want, you shouldn't have to go and edit your
>> site source code every time you want to claim ownership at a new
>> third-party.
>>
>> MicroID doesn't specifically say anything about verifying email,
>> because that is somewhat out of scope. MicroID is a spec for
>> designating that a particular principal owns a particular piece of
>> content. I can use a known identifier for a person to verify if they
>> own any particular piece of content which contains a microid.
>> Someone can claim that they are thomas.huhn at gmail.com, and I can use
>> that identifier to verify that "thomas.huhn at gmail.com" owns a
>> particular piece of content, but that still doesn't verify that the
>> person actually *is* "thomas.huhn at gmail.com". If you are consuming
>> microids in this manner, it's a fundamental principal that you need
>> to verify the identity you are using actually belongs to the user you
>> are verifying for. With OpenID this is automatic, but if you're
>> using email then additional verification is necessary.
>
>
> Ok, I see. So you would propose to better use OpenID and the URI of
> the
> website you claim as your own as the two URIs for the microid? Or
> are there
> any other obstacles (besides not having a verified email adress for
> communication purposes) I´m not aware of at the moment?
well, the identifier you use as the first URI in the microid should
be something that has been verified. This is build-in for OpenIDs,
so that would be the easiest. If you do in fact want to ensure you
have a valid email address, you can certainly use email, but you
would need to verify ownership of that email address out-of-band
(send them some email with a confirmation link they have to follow).
>> (I apologize if my language isn't clear on this... I'm trying to type
>> this in the middle of a meeting, so I can try explaining better later
>> if necessary.
>
> Thanks a lot for spending your time on me, I think I should have
> better
> talked to you before implementing this. ;-).
no problem... I really like this stuff, so it's fun to work on. And
I don't know that you should have talked to *me* specifically about
it... I'm certainly not the expert, but am willing to share what I do
know. The MicroID list would be the best place.
>> Additionally, I'm going to CC the microid list to see
>> if someone there can clarify. Are you on that list?)
>
> Sorry, I´m not, but I´m gonna change this ;-).
probably a good idea... lots of smart people on this list :)
-will
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2448 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/microid/attachments/20070314/08603fb1/attachment.bin
More information about the Microid
mailing list