Microid mailing list

[Evan Prodromou <evan AT prodromou.name>]

On Mon, 2006-20-11 at 13:10 +0200, Yaniv Golan wrote:
> 
> I do have one question though. Do you think that this should be an
> opt-in feature for users or an always-on feature? Is there any
> potential downside to have the user's MicroID published
> automatically? 

As far as I can tell, there's one downside, and that's the privacy
issue. Tying together different identities has its downsides as well as
its upsides.

Let's posit a dissident in a repressive country. She works on
controversial articles ("democracy", "terrorism", whatever) on her
local-language version of Wikipedia. Agents of the government who
_suspect_ that this pseudonymous author is actually jane.doe AT example.com
could use MicroID to test if the two are the same person.

Another example: Under a pseudonym, Fred writes a blog on a public
blogging service with dishy gossip about his company. Embarrassed by the
bad publicity, his company tries verifying the MicroID on the page
against each email address on the company email list until they come up
with a hit on Fred's. He gets fired.

Admittedly, these are extreme situations. But a lot of people who want
to keep their seemingly-innocuous alternate identities distinct from
each other and from their "real" identity. A nosey entity with a big
list of emails and a lot of time could identify any user account they
want. 

For the MicroID extension for MediaWiki that I wrote for Wikitravel, I
added a preference checkbox so that users could control whether or not
to publish a MicroID. I let site administrators decide whether to make
this checkbox default to "on" or "off", and the default for the shipped
extension is "off".

-Evan


-- 
Evan Prodromou <evan AT prodromou.name>