Skip to Content.
Sympa Menu

microid - Re: [Microid] MicroID on Slashdot

microid AT lists.ibiblio.org

Subject: Microid mailing list

List archive

Chronological Thread  
  • From: Peter Saint-Andre <stpeter AT stpeter.im>
  • To: microid AT lists.ibiblio.org
  • Subject: Re: [Microid] MicroID on Slashdot
  • Date: Fri, 29 Aug 2008 23:00:07 -0600

Jer, perhaps it would be a good idea for us to blog about this?

Peter Saint-Andre wrote:
Evan Prodromou wrote:
Interesting article on MicroID on Slashdot:

http://yro.slashdot.org/article.pl?sid=08/08/28/2241238

-Evan

Hi Evan,

Yes the author of that study sent us a copy a while back. We need to add some information about this to the security considerations of the MicroID specification.

Via a private email to the author, Jer posted as follows:

******

If someone's email address is the same as or easily guessable from their social network name/profile, that's an issue regardless of microid being able to confirm it, so I really don't see or care for the spam-angle on this (there are much greater perils in this world of ours).

As far as what I would call the PI-angle, the ability to confirm that an individuals email matches to a given page/profile, that's kind of what the *point* of MicroID is, so yes any site supporting it should have opt in/out and suggest that people use private or custom email addresses (like name+tag@gmail) if they are concerned about privacy.

For historical sake, one of my initial ideas was to have any supporting site provide a private code/pin only to the user that was also hashed, and that user can provide that to anyone to independently confirm the MicroID... but that's a pretty confusing process for your average user to understand, and anyone paranoid can accomplish the same w/ custom email addresses anyway.

******

I'd have to agree with Jer on these points -- it's easier to harvest email addresses in other ways, services need to provide an opt-out (or, better, opt-in) for MicroID usage, people can overcome many of the trivial attacks with throw-away or single-purpose email addresses, and services can use obscured (local) URLs to generate the hashes.

Peter

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature




Archive powered by MHonArc 2.6.24.

Top of Page