Microid mailing list

[Will Norris <will AT willnorris.com>]

The beauty of microid is that I set the microid on my page once and  
leave it there so that I can use it to verify my ownership of the  
page on any number of third party services.  For example, you have a  
constant microid on solution-media.de with a value of  
"8860d6cf2db6ae58d7488d55faa93446abc20aa7".  If I knew what email  
address was used to generate that ID, I could have my OpenID provider  
send over that email address for me and I would be able to claim  
ownership of that site.  While you certainly *can* edit the microid  
on your site anytime you want, you shouldn't have to go and edit your  
site source code every time you want to claim ownership at a new  
third-party.

MicroID doesn't specifically say anything about verifying email,  
because that is somewhat out of scope.  MicroID is a spec for  
designating that a particular principal owns a particular piece of  
content.  I can use a known identifier for a person to verify if they  
own any particular piece of content which contains a microid.   
Someone can claim that they are thomas.huhn AT gmail.com, and I can use  
that identifier to verify that "thomas.huhn AT gmail.com" owns a  
particular piece of content, but that still doesn't verify that the  
person actually *is* "thomas.huhn AT gmail.com".  If you are consuming  
microids in this manner, it's a fundamental principal that you need  
to verify the identity you are using actually belongs to the user you  
are verifying for.  With OpenID this is automatic, but if you're  
using email then additional verification is necessary.

(I apologize if my language isn't clear on this... I'm trying to type  
this in the middle of a meeting, so I can try explaining better later  
if necessary.  Additionally, I'm going to CC the microid list to see  
if someone there can clarify.  Are you on that list?)

-will



On Mar 14, 2007, at 9:34 AM, Thomas Huhn wrote:

> I think you´re missing the point that you have to have the  
> possibility to
> change the sourcecode of the page you claim to be your own. I didn 
> ´t find
> anything about having to verify an email adress in the MicroID specs.
>
> The point is: the verification works only for the moment you  
> verify. You can
> change ANYTHING later on - you can change your email, delete the  
> MicroID on
> your site etc. You can even connect this website to another OpenID  
> and email
> as long as you have the correct (new) MicroID on your site. It´s  
> similar to
> the Wordpress MicroID plugin: you can change your email adress ever  
> after
> and create a new MicroID.
>
> At least as long as you´re using Meta Tags I don´t see a  
> possibility to fake
> the ownership of a site. Maybe the buttons could open a security hole
> (forums that allow html e.g.), but the owner of a site can get the  
> control
> back at any time.
>
> Don´t you agree on that?
>
> -Thomas
>
> 2007/3/14, Will Norris <will AT willnorris.com>:
> > Since email is not verified, but rather just asserted, I don't think
> > you can use it.  If I want to claim a site that I don't actually own,
> > all I have to know is the email address of the actual owner and have
> > my OpenID provider send that email address.  If you had the user
> > verify their asserted mail address by sending them some link, then
> > that would work, but as it is the only thing that is actually
> > verified is the OpenID itself.
> >
> > -will
> >
> >
> > On Mar 14, 2007, at 8:36 AM, Thomas Huhn wrote:
> >
> > > Hi Will,
> > >
> > > thanks for pointing me to this issue and pushing me to a better
> > > solution
> > > :-). You´re absolutely right - this "special implementation" was a
> > > quick
> > > shot and not well thought.
> > >
> > > I´ve fixed this and you will find that everything is conform to the
> > > standards of microid.org now.
> > >
> > > You have a new field for the LinkID which pulls the website URI out
> > > of the
> > > database and the email from your login. These two parameters now
> > > form the
> > > MicroID.
> > > I do use email as one of the URIs because I want to force the
> > > possibility to
> > > send feedback. I know this is somewhat prohibitive because the
> > > users IdP
> > > needs to support SREG, but as there are enough free OpenID
> > > providers out
> > > there this shouldn´t be too much a limitation.
> > >
> > > The verification process is fully automated now. If you still  
> > have any
> > > problems or suggestions, please drop me a line.
> > >
> > > Thomas
> > >
> > > BTW, I updatet
> > > http://blog.openiddirectory.com/2007/03/12/gaining-control-over-
> > > your-link-descriptions/
> > >
> > > 2007/3/14, Will Norris < will AT willnorris.com>:
> > >>
> > >> I was looking at the new OIDD today and trying to figure out  
> > how to
> > >> claim ownership of my Wordpress plugin in the directory.  I found
> > >> your blog entry that discussed it and read the "Promote Your  
> > Votes"
> > >> page, and now I'm feeling quite confident your use of microid is a
> > >> bit "off".  A few red flags for me:
> > >>
> > >>   - the promote page uses a custom meta name "oidd-microid"  
> > instead
> > >> of the name specified in the spec, simply "microid"
> > >>   - the promote page is not asking for the page that I'm claiming
> > >> before generating the microid.  This immediately tells me  
> > something
> > >> is wrong, since that should be the second half of the ID.  I tried
> > >> several combinations of things, and was unable to actually  
> > generate
> > >> the microid that page has, so I can't figure out what URIs you are
> > >> using.
> > >>
> > >> What two URIs are you using?
> > >>
> > >> -will

Attachment: smime.p7s
Description: S/MIME cryptographic signature