[Microid] MicroID on Slashdot

Peter Saint-Andre stpeter at stpeter.im
Sat Aug 30 00:58:25 EDT 2008


Evan Prodromou wrote:
> Interesting article on MicroID on Slashdot:
> 
> http://yro.slashdot.org/article.pl?sid=08/08/28/2241238
> 
> -Evan

Hi Evan,

Yes the author of that study sent us a copy a while back. We need to add 
some information about this to the security considerations of the 
MicroID specification.

Via a private email to the author, Jer posted as follows:

******

If someone's email address is the same as or easily guessable from their 
social network name/profile, that's an issue regardless of microid being 
able to confirm it, so I really don't see or care for the spam-angle on 
this (there are much greater perils in this world of ours).

As far as what I would call the PI-angle, the ability to confirm that an 
individuals email matches to a given page/profile, that's kind of what 
the *point* of MicroID is, so yes any site supporting it should have opt 
in/out and suggest that people use private or custom email addresses 
(like name+tag at gmail) if they are concerned about privacy.

For historical sake, one of my initial ideas was to have any supporting 
site provide a private code/pin only to the user that was also hashed, 
and that user can provide that to anyone to independently confirm the 
MicroID... but that's a pretty confusing process for your average user 
to understand, and anyone paranoid can accomplish the same w/ custom 
email addresses anyway.

******

I'd have to agree with Jer on these points -- it's easier to harvest 
email addresses in other ways, services need to provide an opt-out (or, 
better, opt-in) for MicroID usage, people can overcome many of the 
trivial attacks with throw-away or single-purpose email addresses, and 
services can use obscured (local) URLs to generate the hashes.

Peter
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 6751 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.ibiblio.org/pipermail/microid/attachments/20080829/0b1b88f8/attachment.bin 


More information about the Microid mailing list