Microid mailing list

["Eran Sandler" <eran AT yedda.com>]

As far as I understand microid, there is no place in having a spider crawl
on the web finding microids that are related to me, Eran, and figure out
that all of this content is mine.

If they want to do that, let them go to my claimid.com page. My claimid.com
page has all the necessary pages I've claimed and I stand behind them as my
own on a given identity.

As I've pointed before, having the a domain level based microid compromises
my privacy (Use case: having two different identities on the same web site
with the same Email address that is not publicly available on the website).

The only thing that microid provides is a unique value that a site like
claimid can verify and enable me to claim the content.
A claimid-like site is the site that should check for my authentication and
recognize me as me. 

MicroID is not a replacement for a decentralized authentication system like
OpenID and MUST not provide any means of identifying me directly (or at
least make it very hard to figure my identity).

Of course if I have a set of web pages and a set of email address and each
of these pages have a microid on them I can run a brute force attack and
eventually identify that a certain page was written by a certain user, but
it will still lack the ability to fully prove that that user is the actual
one and not a fake.

That's why the main rule here is: "Only what I claim is mine" (and therefore
MUST have an authority behind it)
Anything else is just a set of hash values, ids or whatever and cannot
guarantee authority.

This point, leads me to the crossing point between microid and openID, but
this should be started on a different thread :-)

Eran


-----Original Message-----
From: microid-bounces AT lists.ibiblio.org
[mailto:microid-bounces AT lists.ibiblio.org] On Behalf Of Peter Saint-Andre
Sent: Tuesday, November 28, 2006 11:43 PM
To: microid AT lists.ibiblio.org
Subject: Re: [Microid] MicroID hashing algorithm(s) and normalization

Peter Saint-Andre wrote:
> Evan Prodromou wrote:
>> On Tue, 2006-28-11 at 14:00 -0700, Peter Saint-Andre wrote:
>>
>> I think we care about associating people with resources. I think making
>> claims to user accounts on different services is a great use case, but
>> it's definitely not the only one.
> 
> Let me see if I understand. Here is Fred's example:
> 
>> Now imagine I have two claimID-like services.  In one I wish
>> to claim my general web reputation (so I would claim
>> http://del.icio.us/fstutzman) and in the other I wanted to
>> claim my facebook-specific reputation (so I would claim
>> http://del.icio.us/fstutzman/facebook).  These are both
>> valuable points of my reputation.
> 
> What are these claimID-like services? Do you have a different identity
> at each one? Let's say you have these two provider URLs:
> 
> 1. http://general.example.org/fred
> 
> 2. http://facebook.example.net/fstutzman
> 
> So delicious mashes up the following to generate microids:
> 
> 1. http://del.icio.us/ + http://general.example.org/fred
> 
>    microid: 9c55b9b46b3033908469c746c4bf0b826953eb07
> 
> 2. http://del.icio.us/ + http://facebook.example.net/fstutzman
> 
>    microid: c5b54608ed5f76fa1573e818dfab9e1227109fec
> 
> Now delicious can plunk 9c55b9b46b3033908469c746c4bf0b826953eb07 in any
> page that relates to your general web reputation (who cares what the URL
> is?) and c5b54608ed5f76fa1573e818dfab9e1227109fec in any page that
> relates to your facebook persona.
> 
> If the microid is different for every URL then I don't see how anyone is
> going to usefully do things like spider all of delicious to find every
> page that relates to your general web presence as opposed to your
> facebook presence (or all the pages on wikitravel that Evan has edited
> or whatever).

Really I do get it. URIs are opaque. If a certain provider wants to
assign a general meaning to microids at that provider's service, then
they can normalize down to <http://del.icio.us/> in generating microids.
But if another provider doesn't want to truncate down to the authority
component they don't have to -- it won't be possible to use microids at
that provider's service in the same general way, but they may have more
particular uses in mind.

Let a thousand flowers bloom!

/psa