Re: Standardizing Firefox's Implementation of Link Fingerprints

[Philip Guenther <[e-mail]>]

On Mon, 2 Jul 2007, Edward Lee wrote:
> For Firefox 3, there are patches [1] that implement Link Fingerprints,
> which provide automatic resource verification for URIs that look like
> http://site.com/file#hash(sha256:abc123) so that link providers can be
> sure that end users download the exact file that the provider intended
> (and not a trojaned download).

This sounds a lot like the hash-scheme for making text fragment 
identifiers robust that's proposed in

    http://www.ietf.org/internet-drafts/draft-wilde-text-fragment-06.txt

The goals are not quite parallel as the above doesn't support hashing 
without also specifying a position, while your draft pictures a general 
syntax for schema and content-type independent signing.  The overlap does 
seem considerably though, if just because a content-type independent 
method would render the text/plain specific one obsolete.

Putting general object metadata in the fragment seems contorted though. 
For the hash-scheme stuff in draft-wilde-text-fragment there's at least a 
tenuous association with positioning information, but even then it's a 
stretch.

(Is there any normal textual representation for an http URL plus an etag 
or other identity verifier?  imap URLs put the mailbox UIDVALIDITY, which 
is an identity verifier for the mailbox as an object, in the path part.)


Philip Guenther
Sendmail, Inc.