Skip to Content.
Sympa Menu

microid - Re: [Microid] microid on OIDD

microid AT lists.ibiblio.org

Subject: Microid mailing list

List archive

Chronological Thread  
  • From: Will Norris <will AT willnorris.com>
  • To: Thomas Huhn <thomas.huhn AT gmail.com>
  • Cc: microid AT lists.ibiblio.org
  • Subject: Re: [Microid] microid on OIDD
  • Date: Wed, 14 Mar 2007 12:07:53 -0700


On Mar 14, 2007, at 11:29 AM, Thomas Huhn wrote:

Hi Will,

thanks for clarifying some aspects, but I still have a couple of questions
..

2007/3/14, Will Norris <will AT willnorris.com>:

The beauty of microid is that I set the microid on my page once and
leave it there so that I can use it to verify my ownership of the
page on any number of third party services. For example, you have a
constant microid on solution-media.de with a value of
"8860d6cf2db6ae58d7488d55faa93446abc20aa7". If I knew what email
address was used to generate that ID, I could have my OpenID provider
send over that email address for me and I would be able to claim
ownership of that site.

While you certainly *can* edit the microid
on your site anytime you want, you shouldn't have to go and edit your
site source code every time you want to claim ownership at a new
third-party.

MicroID doesn't specifically say anything about verifying email,
because that is somewhat out of scope. MicroID is a spec for
designating that a particular principal owns a particular piece of
content. I can use a known identifier for a person to verify if they
own any particular piece of content which contains a microid.
Someone can claim that they are thomas.huhn AT gmail.com, and I can use
that identifier to verify that "thomas.huhn AT gmail.com" owns a
particular piece of content, but that still doesn't verify that the
person actually *is* "thomas.huhn AT gmail.com". If you are consuming
microids in this manner, it's a fundamental principal that you need
to verify the identity you are using actually belongs to the user you
are verifying for. With OpenID this is automatic, but if you're
using email then additional verification is necessary.


Ok, I see. So you would propose to better use OpenID and the URI of the
website you claim as your own as the two URIs for the microid? Or are there
any other obstacles (besides not having a verified email adress for
communication purposes) I´m not aware of at the moment?

well, the identifier you use as the first URI in the microid should be something that has been verified. This is build-in for OpenIDs, so that would be the easiest. If you do in fact want to ensure you have a valid email address, you can certainly use email, but you would need to verify ownership of that email address out-of-band (send them some email with a confirmation link they have to follow).

(I apologize if my language isn't clear on this... I'm trying to type
this in the middle of a meeting, so I can try explaining better later
if necessary.

Thanks a lot for spending your time on me, I think I should have better
talked to you before implementing this. ;-).

no problem... I really like this stuff, so it's fun to work on. And I don't know that you should have talked to *me* specifically about it... I'm certainly not the expert, but am willing to share what I do know. The MicroID list would be the best place.


Additionally, I'm going to CC the microid list to see
if someone there can clarify. Are you on that list?)

Sorry, I´m not, but I´m gonna change this ;-).

probably a good idea... lots of smart people on this list :)

-will

Attachment: smime.p7s
Description: S/MIME cryptographic signature




Archive powered by MHonArc 2.6.24.

Top of Page