MicroID
≈ 2 min read
Names in other languages
No names in other languages are held for this entry yet.
Article bodies are English and are not machine-translated. A name in another language is not a translation of the article.
MicroID is a decentralized identity protocol. It was originally developed in 2005 by Jeremie Miller A MicroID is a simple identifier comprising a hashed communication/identity [[Uniform Resource Identifier|URI] (e.g. email, OpenID, and/or Yadis) and claimed URL. Together, the two elements create a hash that can be claimed by third-party services. Ben Laurie demonstrated privacy problems with it in 2006 , as did Chris Erway in a Brown CS Technical Report in 2008
MicroID is a decentralized identity protocol. It was originally developed in 2005 by Jeremie Miller A MicroID is a simple identifier comprising a hashed communication/identity URI (e.g. email, OpenID, and/or Yadis) and claimed URL. Together, the two elements create a hash that can be claimed by third-party services. Ben Laurie demonstrated privacy problems with it in 2006 , as did Chris Erway in a Brown CS Technical Report in 2008 MicroID = sha1( sha1(" mailto:user@example.com ") + sha1(" http://example.net/ ") ); The computed MicroID would then be placed on a web page to be claimed. A verifier, which would independently generate the MicroID, would then visit the page to see if the generated MicroID is the same as the MicroID on the page. If they are the same, a claim exists. MicroID is based on a communication URI. Since both the MicroID provider and verifier can verify the communication URI, a proper MicroID implementation allows for trusted identity claims. Assuming the identity is not known (e.g. 1) the publisher has chosen to remain anonymous and 2) denies others the ability to verify the MicroID claim until a time in the future when the use reveals their identity) then someone with email addresses can perform a trivial dictionary attack to find ownership of resources, [http://www.links.org/?p=85 someone with a URI can perform a trivial dictionary attack to find an email address.[http://yro.slashdot.org/yro/08/08/28/2241238.shtml] So the (only) remaining usecase is where an entity generates a strong cryptographic nonce (e.g. a UUID); uses this to publish documents over time—and at some time in the future reveals the UUID as to prove that the use wrote those documents (and accepts that from that point forward anyone can make any claims on his or her behalf). ==References==
Text derived from https://en.wikipedia.org/w/index.php?oldid=1372324866 under CC BY-SA 4.0; modifications have been made.