Re: [saag] Liking Linkability

Henry Story <> Mon, 22 October 2012 10:33 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 8D89E21F88FC for <>; Mon, 22 Oct 2012 03:33:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.299
X-Spam-Status: No, score=-3.299 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, J_CHICKENPOX_25=0.6, RCVD_IN_DNSWL_LOW=-1]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id kmodJRgc4usc for <>; Mon, 22 Oct 2012 03:33:20 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 3B16B21F8798 for <>; Mon, 22 Oct 2012 03:33:19 -0700 (PDT)
Received: by with SMTP id jc3so806353bkc.31 for <>; Mon, 22 Oct 2012 03:33:19 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=subject:mime-version:content-type:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=jnsVPx4NCR1kU9y6fsg282xNrM4Ae3+QdeeXw4tmnAU=; b=VUlmaKu9nFZwJ4MDx72pjHUAq1TFlI9OCYoEAU6ZoXWWo9CGLuUGUK7gIgfbCz0tmm bxfNXUlU9bnFBIkuOrft/ZInVNkYSNIYUdJfOjiIipYVaMaUESLP9MubeFKsiyCUMdWZ gbEEv0EM3tOSYH7yyS69d5QFGJnX/EsiMHf066w/4/AkenFdNqN7Fxm5ixC4QRGem+Ju QO6jIBIKxJZzzG15etE7/PJndizWhXmIi79ibNOI/vb9F0ZMvZdCQS8t/YTTAlX2+3ZZ zoqchydrAb+9cozdYKs+m2GPawDLCPGoxboPWsIJXYsw/VBcDT4hQJshvvNobsBheUS0 dOxg==
Received: by with SMTP id f10mr2434855bkv.98.1350901999006; Mon, 22 Oct 2012 03:33:19 -0700 (PDT)
Received: from bblfish.home ( []) by with ESMTPS id ia2sm3095496bkc.11.2012. (version=SSLv3 cipher=OTHER); Mon, 22 Oct 2012 03:33:09 -0700 (PDT)
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
Content-Type: multipart/signed; boundary="Apple-Mail=_E42F4074-0A40-49D7-B029-5B8C9E3FEBC4"; protocol="application/pkcs7-signature"; micalg=sha1
From: Henry Story <>
In-Reply-To: <>
Date: Mon, 22 Oct 2012 12:33:06 +0200
Message-Id: <>
References: <> <> <201210181904.PAA07773@Sparkle.Rodents-Montreal.ORG> <> <> <> <> <> <> <> <> <> <> <> <>
To: Ben Laurie <>
X-Mailer: Apple Mail (2.1499)
X-Gm-Message-State: ALoCoQnAqQjyqk4nhyYqQ5qVCZkqsfl+86hId89xZ+RRa5mN6z3cs6Uf5SxiTbOoUix9VbTsR1q6
Cc:,,, " list" <>
Subject: Re: [saag] Liking Linkability
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Advisory Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 22 Oct 2012 10:33:21 -0000

[cutting down on the mailing lists]

On 22 Oct 2012, at 11:54, Ben Laurie <> wrote:

> Where we came in was me pointing out that if you disconnect your
> identities by using multiple WebIDs, then you have a UI problem, and
> since then the aim seems to have been to persuade us that multiple
> WebIDs are not needed.

There is a happy medium on UI experience. For the UI experience
there are two seperate issues, one of which I proposed a fix for
and the other of which is a browser UI issue.

A. Number of WebIDs

1. WebID per web site:

You don't want to have one WebID per site you go to, since the point 
of WebID is to allow you to authenticate across sites using the same 
ID ( in the case of TLS, a URL embedded in an X509 Certificate's SAN 
field ).

2. One and only one WebID for the whole internet per person

 WebID does not force any such restrictions (neither would OpenId
or BrowserId for that matter ). 

3. As many WebID's for the whole web as the user feels worth investing in

The first sentence of the spec says so ( )

The WebID protocol enables secure, efficient and maximally user friendly authentication on the Web. It enables people to authenticate onto any site by simply clicking on one of the certificates proposed to them by their browser. These certificates can be created by any Web Site for their users in one click. The identifier, known as the WebID, is a URI whose sense can be found in the associated Profile Page, a type of web page that any Social Network user is familiar with.

( so we are looking for help improving the wording)

Finally, (3) above does not mean that the user can only use WebID. He can still use
all the existing technologies for authenticating to web sites where he 
wishes to have non cross-site linkable identities - e.g. cookies, with username
password for example if needed, ...

UI Experience

There are two elements to the UI experience

1. Certificate selection

  If the server requesting the certificate from the user makes a CertificateRequest
by leaving the certificate_authorities field blank ( or null, not sure what the
correct wording is ) as explained by the spec currently

then users with multiple certificates - some of which may not be WebID enabled -
then those users will be presented with a selection box containing certificates
that are not in fact ones the server will accept - leading to confusion and a 
bad UI. I just proposed on the WebID mailing list that WebID certificate chains
be signed (at some point) by CN=WebID,O=∅ to solve this issue.

2. Transparency of Identity

 It is not clear currently when you go to a web site if you are authenticated or not,
or with what identities you are. Even Google Chromes' Profile feature does not do so.
This is something I really hope they will fix by inspiring themselves from Aza Raskin's

I hope this helps,


Social Web Architect