Skip to Content.
Sympa Menu

microid - Re: [Microid] microid on OIDD

microid AT lists.ibiblio.org

Subject: Microid mailing list

List archive

Chronological Thread  
  • From: Will Norris <will AT willnorris.com>
  • To: Thomas Huhn <thomas.huhn AT gmail.com>
  • Cc: microid AT lists.ibiblio.org
  • Subject: Re: [Microid] microid on OIDD
  • Date: Wed, 14 Mar 2007 10:08:37 -0700

The beauty of microid is that I set the microid on my page once and leave it there so that I can use it to verify my ownership of the page on any number of third party services. For example, you have a constant microid on solution-media.de with a value of "8860d6cf2db6ae58d7488d55faa93446abc20aa7". If I knew what email address was used to generate that ID, I could have my OpenID provider send over that email address for me and I would be able to claim ownership of that site. While you certainly *can* edit the microid on your site anytime you want, you shouldn't have to go and edit your site source code every time you want to claim ownership at a new third-party.

MicroID doesn't specifically say anything about verifying email, because that is somewhat out of scope. MicroID is a spec for designating that a particular principal owns a particular piece of content. I can use a known identifier for a person to verify if they own any particular piece of content which contains a microid. Someone can claim that they are thomas.huhn AT gmail.com, and I can use that identifier to verify that "thomas.huhn AT gmail.com" owns a particular piece of content, but that still doesn't verify that the person actually *is* "thomas.huhn AT gmail.com". If you are consuming microids in this manner, it's a fundamental principal that you need to verify the identity you are using actually belongs to the user you are verifying for. With OpenID this is automatic, but if you're using email then additional verification is necessary.

(I apologize if my language isn't clear on this... I'm trying to type this in the middle of a meeting, so I can try explaining better later if necessary. Additionally, I'm going to CC the microid list to see if someone there can clarify. Are you on that list?)

-will



On Mar 14, 2007, at 9:34 AM, Thomas Huhn wrote:

I think you´re missing the point that you have to have the possibility to
change the sourcecode of the page you claim to be your own. I didn ´t find
anything about having to verify an email adress in the MicroID specs.

The point is: the verification works only for the moment you verify. You can
change ANYTHING later on - you can change your email, delete the MicroID on
your site etc. You can even connect this website to another OpenID and email
as long as you have the correct (new) MicroID on your site. It´s similar to
the Wordpress MicroID plugin: you can change your email adress ever after
and create a new MicroID.

At least as long as you´re using Meta Tags I don´t see a possibility to fake
the ownership of a site. Maybe the buttons could open a security hole
(forums that allow html e.g.), but the owner of a site can get the control
back at any time.

Don´t you agree on that?

-Thomas

2007/3/14, Will Norris <will AT willnorris.com>:

Since email is not verified, but rather just asserted, I don't think
you can use it. If I want to claim a site that I don't actually own,
all I have to know is the email address of the actual owner and have
my OpenID provider send that email address. If you had the user
verify their asserted mail address by sending them some link, then
that would work, but as it is the only thing that is actually
verified is the OpenID itself.

-will


On Mar 14, 2007, at 8:36 AM, Thomas Huhn wrote:

> Hi Will,
>
> thanks for pointing me to this issue and pushing me to a better
> solution
> :-). You´re absolutely right - this "special implementation" was a
> quick
> shot and not well thought.
>
> I´ve fixed this and you will find that everything is conform to the
> standards of microid.org now.
>
> You have a new field for the LinkID which pulls the website URI out
> of the
> database and the email from your login. These two parameters now
> form the
> MicroID.
> I do use email as one of the URIs because I want to force the
> possibility to
> send feedback. I know this is somewhat prohibitive because the
> users IdP
> needs to support SREG, but as there are enough free OpenID
> providers out
> there this shouldn´t be too much a limitation.
>
> The verification process is fully automated now. If you still have any
> problems or suggestions, please drop me a line.
>
> Thomas
>
> BTW, I updatet
> http://blog.openiddirectory.com/2007/03/12/gaining-control-over-
> your-link-descriptions/
>
> 2007/3/14, Will Norris < will AT willnorris.com>:
>>
>> I was looking at the new OIDD today and trying to figure out how to
>> claim ownership of my Wordpress plugin in the directory. I found
>> your blog entry that discussed it and read the "Promote Your Votes"
>> page, and now I'm feeling quite confident your use of microid is a
>> bit "off". A few red flags for me:
>>
>> - the promote page uses a custom meta name "oidd-microid" instead
>> of the name specified in the spec, simply "microid"
>> - the promote page is not asking for the page that I'm claiming
>> before generating the microid. This immediately tells me something
>> is wrong, since that should be the second half of the ID. I tried
>> several combinations of things, and was unable to actually generate
>> the microid that page has, so I can't figure out what URIs you are
>> using.
>>
>> What two URIs are you using?
>>
>> -will

Attachment: smime.p7s
Description: S/MIME cryptographic signature




Archive powered by MHonArc 2.6.24.

Top of Page