Re: Question/idea: Self-contained WebID

You're entirely correct, except that I was talking about OpenID, not WebID
^_~

To the point of WebID, since in the simplest case you only need to host a
static file, I don't see much of a problem here. You can host it on a
website, on Google Drive, Dropbox or a host of other free and convenient
places. I believe Kingsley's YouID apps offers this functionality.

I haven't actively followed WebID for a long time, so there's one thing I'm
wondering about how it's handled. What do services offering WebID use to
identify users?

The public key? -> What happens when the user's certificate expires or when
he looses control of it?
The URI? How can a user change their WebID URI?
Or something else?


On Wed, May 28, 2014 at 4:38 PM, Mo McRoberts <Mo.McRoberts@bbc.co.uk>wrote:

>
> On  2014-May-28, at 06:20, Daniël Bos <corani@gmail.com> wrote:
>
> > OpenID can actually run locally, since the browser handles all the
> redirects. In the past I've used an OpenID provider running on localhost.
> This could just as easily have been baked into the browser.
>
> That’s going to very much depend upon the server. There’s nothing about
> that which is guaranteed to work. The server you’re communicating with
> *should* be able to dereference the URI in the certificate as a means of
> (1) verifying your WebID (the URI), and (2) performing attribute exchange.
>
> A local-only server will only work if the above happens client-side, which
> itself would make me nervous.
>
> The whole point of hosting the FOAF (or equivalent) somewhere accessible
> is that the server being able to fetch it, and its contents matching your
> key, is a way of confirming that the URI you’re claiming to control is
> actually something you control. It’s the server which needs to obtain this
> verification, not the browser. The browser doesn’t have any particular
> reason to care.
>
> A local-only server would be the equivalent of verifying your e-mail
> address on a site which requires it, but only running a mail server which
> is also bound only to localhost.
>
> M.
>
> --
> Mo McRoberts - Chief Technical Architect - Archives & Digital Public Space,
> Zone 2.12, BBC Scotland, 40 Pacific Quay, Glasgow G51 1DA.
>
> Inside the BBC? My movements this week: http://neva.li/where-is-mo
>
>
>
>
>
>
>


-- 
--
Best regards,
Daniël Bos

Your government is reading your email. Slow them down with encryption.

My public key: http://goo.gl/gms497