Microid mailing list

[Will Norris <will AT willnorris.com>]

On Mar 14, 2007, at 11:29 AM, Thomas Huhn wrote:

> Hi Will,
>
> thanks for clarifying some aspects, but I still have a couple of  
> questions
> ..
>
> 2007/3/14, Will Norris <will AT willnorris.com>:
> > The beauty of microid is that I set the microid on my page once and
> > leave it there so that I can use it to verify my ownership of the
> > page on any number of third party services.  For example, you have a
> > constant microid on solution-media.de with a value of
> > "8860d6cf2db6ae58d7488d55faa93446abc20aa7".  If I knew what email
> > address was used to generate that ID, I could have my OpenID provider
> > send over that email address for me and I would be able to claim
> > ownership of that site.
> >
> > While you certainly *can* edit the microid
> > on your site anytime you want, you shouldn't have to go and edit your
> > site source code every time you want to claim ownership at a new
> > third-party.
> >
> > MicroID doesn't specifically say anything about verifying email,
> > because that is somewhat out of scope.  MicroID is a spec for
> > designating that a particular principal owns a particular piece of
> > content.  I can use a known identifier for a person to verify if they
> > own any particular piece of content which contains a microid.
> > Someone can claim that they are thomas.huhn AT gmail.com, and I can use
> > that identifier to verify that "thomas.huhn AT gmail.com" owns a
> > particular piece of content, but that still doesn't verify that the
> > person actually *is* "thomas.huhn AT gmail.com".  If you are consuming
> > microids in this manner, it's a fundamental principal that you need
> > to verify the identity you are using actually belongs to the user you
> > are verifying for.  With OpenID this is automatic, but if you're
> > using email then additional verification is necessary.
>
>
> Ok, I see. So you would propose to better use OpenID and the URI of  
> the
> website you claim as your own as the two URIs for the microid? Or  
> are there
> any other obstacles (besides not having a verified email adress for
> communication purposes) I´m not aware of at the moment?

well, the identifier you use as the first URI in the microid should  
be something that has been verified.  This is build-in for OpenIDs,  
so that would be the easiest.  If you do in fact want to ensure you  
have a valid email address, you can certainly use email, but you  
would need to verify ownership of that email address out-of-band  
(send them some email with a confirmation link they have to follow).

> > (I apologize if my language isn't clear on this... I'm trying to type
> > this in the middle of a meeting, so I can try explaining better later
> > if necessary.
>
> Thanks a lot for spending your time on me, I think I should have  
> better
> talked to you before implementing this. ;-).

no problem... I really like this stuff, so it's fun to work on.  And  
I don't know that you should have talked to *me* specifically about  
it... I'm certainly not the expert, but am willing to share what I do  
know.  The MicroID list would be the best place.


> > Additionally, I'm going to CC the microid list to see
> > if someone there can clarify.  Are you on that list?)
>
> Sorry, I´m not, but I´m gonna change this ;-).

probably a good idea... lots of smart people on this list :)

-will

Attachment: smime.p7s
Description: S/MIME cryptographic signature