Tech Report CS-08-09
MicroID considered harmful (to privacy)
C. Chris Erway
August 2008
Abstract:
MicroID is a deployed Internet standard designed for use as a lightweight, decentralized identity primitive in web applications and communities. This study presents the standard's specification and deployment, and analyzes the security and privacy of MicroID, describing attacks that can be used to compromise the privacy of its users. Although it has been described by its designers as privacy-preserving, in practice the deployment of MicroID has put the private information of many of its millions of unwitting users at risk of compromise. We provide recommendations for changes to the standard and its deployment which prevent these attacks.(complete text in pdf)
| Page Owner: Eugenia G. deGouveia | Last Modified: Fri Aug 22 16:45:37 2008 |