[Microid] microid on OIDD
jer
jeremie at jabber.org
Wed Mar 14 22:04:23 EST 2007
Ahh, if I get this thread correctly then, you're using a microid to
"bond" additional pages/URIs to an already verified OpenID URI. Yes,
this should work perfectly, of course you can just publish the
original OpenID URI inside the content openly, unless you have some
privacy reason to obscure it (which is really what microid is doing).
Jer
On Mar 14, 2007, at 3:07 PM, Will Norris wrote:
>
> On Mar 14, 2007, at 11:29 AM, Thomas Huhn wrote:
>
>> Hi Will,
>>
>> thanks for clarifying some aspects, but I still have a couple of
>> questions
>> ..
>>
>> 2007/3/14, Will Norris <will at willnorris.com>:
>>>
>>> The beauty of microid is that I set the microid on my page once and
>>> leave it there so that I can use it to verify my ownership of the
>>> page on any number of third party services. For example, you have a
>>> constant microid on solution-media.de with a value of
>>> "8860d6cf2db6ae58d7488d55faa93446abc20aa7". If I knew what email
>>> address was used to generate that ID, I could have my OpenID
>>> provider
>>> send over that email address for me and I would be able to claim
>>> ownership of that site.
>>>
>>> While you certainly *can* edit the microid
>>> on your site anytime you want, you shouldn't have to go and edit
>>> your
>>> site source code every time you want to claim ownership at a new
>>> third-party.
>>>
>>> MicroID doesn't specifically say anything about verifying email,
>>> because that is somewhat out of scope. MicroID is a spec for
>>> designating that a particular principal owns a particular piece of
>>> content. I can use a known identifier for a person to verify if
>>> they
>>> own any particular piece of content which contains a microid.
>>> Someone can claim that they are thomas.huhn at gmail.com, and I can use
>>> that identifier to verify that "thomas.huhn at gmail.com" owns a
>>> particular piece of content, but that still doesn't verify that the
>>> person actually *is* "thomas.huhn at gmail.com". If you are consuming
>>> microids in this manner, it's a fundamental principal that you need
>>> to verify the identity you are using actually belongs to the user
>>> you
>>> are verifying for. With OpenID this is automatic, but if you're
>>> using email then additional verification is necessary.
>>
>>
>> Ok, I see. So you would propose to better use OpenID and the URI
>> of the
>> website you claim as your own as the two URIs for the microid? Or
>> are there
>> any other obstacles (besides not having a verified email adress for
>> communication purposes) I´m not aware of at the moment?
>
> well, the identifier you use as the first URI in the microid should
> be something that has been verified. This is build-in for OpenIDs,
> so that would be the easiest. If you do in fact want to ensure you
> have a valid email address, you can certainly use email, but you
> would need to verify ownership of that email address out-of-band
> (send them some email with a confirmation link they have to follow).
>
>>> (I apologize if my language isn't clear on this... I'm trying to
>>> type
>>> this in the middle of a meeting, so I can try explaining better
>>> later
>>> if necessary.
>>
>> Thanks a lot for spending your time on me, I think I should have
>> better
>> talked to you before implementing this. ;-).
>
> no problem... I really like this stuff, so it's fun to work on.
> And I don't know that you should have talked to *me* specifically
> about it... I'm certainly not the expert, but am willing to share
> what I do know. The MicroID list would be the best place.
>
>
>>> Additionally, I'm going to CC the microid list to see
>>> if someone there can clarify. Are you on that list?)
>>
>> Sorry, I´m not, but I´m gonna change this ;-).
>
> probably a good idea... lots of smart people on this list :)
>
> -will
>
> _______________________________________________
> Microid mailing list
> Microid at lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/microid
More information about the Microid
mailing list