Microid mailing list

[Peter Saint-Andre <stpeter AT stpeter.im>]

Jer, perhaps it would be a good idea for us to blog about this?

Peter Saint-Andre wrote:
> Evan Prodromou wrote:
> > Interesting article on MicroID on Slashdot:
> >
> > http://yro.slashdot.org/article.pl?sid=08/08/28/2241238
> >
> > -Evan
>
> Hi Evan,
>
> Yes the author of that study sent us a copy a while back. We need to add 
> some information about this to the security considerations of the 
> MicroID specification.
>
> Via a private email to the author, Jer posted as follows:
>
> ******
>
> If someone's email address is the same as or easily guessable from their 
> social network name/profile, that's an issue regardless of microid being 
> able to confirm it, so I really don't see or care for the spam-angle on 
> this (there are much greater perils in this world of ours).
>
> As far as what I would call the PI-angle, the ability to confirm that an 
> individuals email matches to a given page/profile, that's kind of what 
> the *point* of MicroID is, so yes any site supporting it should have opt 
> in/out and suggest that people use private or custom email addresses 
> (like name+tag@gmail) if they are concerned about privacy.
>
> For historical sake, one of my initial ideas was to have any supporting 
> site provide a private code/pin only to the user that was also hashed, 
> and that user can provide that to anyone to independently confirm the 
> MicroID... but that's a pretty confusing process for your average user 
> to understand, and anyone paranoid can accomplish the same w/ custom 
> email addresses anyway.
>
> ******
>
> I'd have to agree with Jer on these points -- it's easier to harvest 
> email addresses in other ways, services need to provide an opt-out (or, 
> better, opt-in) for MicroID usage, people can overcome many of the 
> trivial attacks with throw-away or single-purpose email addresses, and 
> services can use obscured (local) URLs to generate the hashes.
>
> Peter

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature