MicroID Development

Based on some feedback we received from Evan Prodromou on the discussion list back in August, we have updated the MicroID Internet-Draft. The new version is draft-miller-microid-01 and it is available both at microid.org and ietf.org.

I’ve created a mailing list for the MicroID community.  The address is , and you can subscribe to the list at http://lists.ibiblio.org/mailman/listinfo/microid.  This list will be open, and the archives will be public.  If you’re interested in MicroID, want to keep up with the spec, or want to connect with other folks implementing MicroID, this list will be useful to you.

In other news, I’ll be hanging out in the #microid channel on irc.freenode.net.  If you’re interested in chatting about MicroID or have quick questions, you may be able to find people in the channel.

One of the most fascinating experiences resulting from publishing MicroID has been the way that people try to understand it. It’s clear that I didn’t explain how I expect it to be used well enough, so this post is the start of a living FAQ I’ll be building through this blog and based on the comments posted (so post any new questions please!):

Q: Anyone can make a MicroID for me if they know my email address, how does that prove anything?
A: Yes! A MicroID doesn’t prevent spoofing, it simply enables ownership verification. I know that doesn’t make sense, but think about it with a real world example, pet tags. You put your phone number on your pet’s collar (or microchip implant these days) to identify that pet as yours. Sure, anyone can label their pet as yours, but what do you care? With the microchip example it’s even more clear, when you go to the vet they can check your ID and match it with the implant owner data, they validate that you own that pet. MicroID allows a service to validate that the content you link to on some other site, is actually yours if you claim it to be.

Q: How’s this any different than doing something like this?
<meta name=”contact” content=”mailto:” />
A: It’s functionally identical, publishing your email address allows the exact same level of ownership demonstration. Compare to the MicroID example:
<meta name=”microid” content=”9d6d3552e3304340849837313b0e34833e4c599b”/>
The only difference is the MicroID doesn’t expose the address, and you only have to reveal the address privately to those that you want to show ownership to. That’s enough reason alone to be useful.

Q: What identifiers can be used instead of email?
A: The only requirement is that the identifier you use as the source is
verifiable; email address, IM handle, phone number, even a PKI token, anything that
enables one to validate it. It’s only as strong as your ability to
verify that identifier is, which with email-confirmations is (un)
fortunately a very common practice and acceptable level of confidence for most systems.

Q: So my home page can now be verified as mine by just checking my email address, so what?
A: My perspective comes from online reputations, particularly
the reputation silos that are all of the various comment and content
moderation systems out there. Individuals put a lot of work into
building a reputation on all of these web communities, and that
effort isn’t portable today. By using MicroID and exposing a contact-
able identifier along with any of your posted content/comments on any of those systems you
can demonstrate/validate ownership of that reputation. MicroID is just an
alternative that provides this basic utility without forcing the
identifier into the public.