From evan at prodromou.name Sat Aug 30 00:26:55 2008 From: evan at prodromou.name (Evan Prodromou) Date: Sat, 30 Aug 2008 00:26:55 -0400 Subject: [Microid] MicroID on Slashdot Message-ID: <1220070415.9479.0.camel@holden.4690ruepontiac.net> Interesting article on MicroID on Slashdot: http://yro.slashdot.org/article.pl?sid=08/08/28/2241238 -Evan -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.ibiblio.org/pipermail/microid/attachments/20080830/9b2f5d8e/attachment.html -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 5175 bytes Desc: not available Url : http://lists.ibiblio.org/pipermail/microid/attachments/20080830/9b2f5d8e/attachment.bin From stpeter at stpeter.im Sat Aug 30 00:58:25 2008 From: stpeter at stpeter.im (Peter Saint-Andre) Date: Fri, 29 Aug 2008 22:58:25 -0600 Subject: [Microid] MicroID on Slashdot In-Reply-To: <1220070415.9479.0.camel@holden.4690ruepontiac.net> References: <1220070415.9479.0.camel@holden.4690ruepontiac.net> Message-ID: <48B8D371.6000704@stpeter.im> Evan Prodromou wrote: > Interesting article on MicroID on Slashdot: > > http://yro.slashdot.org/article.pl?sid=08/08/28/2241238 > > -Evan Hi Evan, Yes the author of that study sent us a copy a while back. We need to add some information about this to the security considerations of the MicroID specification. Via a private email to the author, Jer posted as follows: ****** If someone's email address is the same as or easily guessable from their social network name/profile, that's an issue regardless of microid being able to confirm it, so I really don't see or care for the spam-angle on this (there are much greater perils in this world of ours). As far as what I would call the PI-angle, the ability to confirm that an individuals email matches to a given page/profile, that's kind of what the *point* of MicroID is, so yes any site supporting it should have opt in/out and suggest that people use private or custom email addresses (like name+tag at gmail) if they are concerned about privacy. For historical sake, one of my initial ideas was to have any supporting site provide a private code/pin only to the user that was also hashed, and that user can provide that to anyone to independently confirm the MicroID... but that's a pretty confusing process for your average user to understand, and anyone paranoid can accomplish the same w/ custom email addresses anyway. ****** I'd have to agree with Jer on these points -- it's easier to harvest email addresses in other ways, services need to provide an opt-out (or, better, opt-in) for MicroID usage, people can overcome many of the trivial attacks with throw-away or single-purpose email addresses, and services can use obscured (local) URLs to generate the hashes. Peter -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 6751 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.ibiblio.org/pipermail/microid/attachments/20080829/0b1b88f8/attachment.bin From stpeter at stpeter.im Sat Aug 30 01:00:07 2008 From: stpeter at stpeter.im (Peter Saint-Andre) Date: Fri, 29 Aug 2008 23:00:07 -0600 Subject: [Microid] MicroID on Slashdot In-Reply-To: <48B8D371.6000704@stpeter.im> References: <1220070415.9479.0.camel@holden.4690ruepontiac.net> <48B8D371.6000704@stpeter.im> Message-ID: <48B8D3D7.9030804@stpeter.im> Jer, perhaps it would be a good idea for us to blog about this? Peter Saint-Andre wrote: > Evan Prodromou wrote: >> Interesting article on MicroID on Slashdot: >> >> http://yro.slashdot.org/article.pl?sid=08/08/28/2241238 >> >> -Evan > > Hi Evan, > > Yes the author of that study sent us a copy a while back. We need to add > some information about this to the security considerations of the > MicroID specification. > > Via a private email to the author, Jer posted as follows: > > ****** > > If someone's email address is the same as or easily guessable from their > social network name/profile, that's an issue regardless of microid being > able to confirm it, so I really don't see or care for the spam-angle on > this (there are much greater perils in this world of ours). > > As far as what I would call the PI-angle, the ability to confirm that an > individuals email matches to a given page/profile, that's kind of what > the *point* of MicroID is, so yes any site supporting it should have opt > in/out and suggest that people use private or custom email addresses > (like name+tag at gmail) if they are concerned about privacy. > > For historical sake, one of my initial ideas was to have any supporting > site provide a private code/pin only to the user that was also hashed, > and that user can provide that to anyone to independently confirm the > MicroID... but that's a pretty confusing process for your average user > to understand, and anyone paranoid can accomplish the same w/ custom > email addresses anyway. > > ****** > > I'd have to agree with Jer on these points -- it's easier to harvest > email addresses in other ways, services need to provide an opt-out (or, > better, opt-in) for MicroID usage, people can overcome many of the > trivial attacks with throw-away or single-purpose email addresses, and > services can use obscured (local) URLs to generate the hashes. > > Peter > -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 6751 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.ibiblio.org/pipermail/microid/attachments/20080829/fc624c6c/attachment.bin