WebID

Not to be confused with WeBid, the online auction software.

The WebID specifications[1] define a set of proposed standards for Identity, identification and authentication on HTTP based networks.

WebID

A WebID is an HTTP URI that denotes ("refers to" or "names)" an agent on HTTP based networks e.g., the Web or an enterprise Intranet. In line with Linked Data principles, when you de-reference ("look up") a WebID, it resolves to a profile document that describes its referent (what it denotes). This profile document consists of RDF model based structured data, constructed initially using terms from the FOAF vocabulary, but now often including terms from other vocabularies.

Profile documents can be stored on the agent's own Web server, and access thereto may be partially or wholly constrained to specific agent identities via the use of access controls, to preserve the privacy of the profile document's subject.

WebID+TLS

The WebID+TLS protocol (formerly known as FOAF+SSL[2]) is a decentralized and secure authentication protocol built upon the profile information as well as the Transport Layer Security (TLS) client certificates available in virtually all modern web browsers. It was first presented [3][4] for the W3C Workshop on the Future of Social Networking in 2009.

Contrary to the usual SSL usage patterns, it does not require[5] a dedicated Certificate authority to perform the user authorization. Users can easily mint useful identities for themselves using any TLS certificate (even self-signed ones). Using TLS client certificates for Web site user authentication doesn't usually require that the user input a password, unlike many other single sign-on mechanisms, which can make WebID+TLS quite convenient. However, the client certificate selection dialogues in popular Web browsers are not yet as user-friendly as they might be, negating some of this convenience.

A web of trust based on WebID+TLS could be gradually constructed, connecting users and their activities on the World Wide Web, without formal key signing parties, making the identification harder for anyone (even the original issuing authority) to falsify.[6]

References

  1. ↑ W3C WebID Incubator Group
  2. ↑ FOAF+SSL decentralized authentication protocol.
  3. ↑ "foaf+ssl: adding security to open distributed social networks". Sun Microsystems.
  4. ↑ "Workshop on the Future of Social Networking". Barcelona, ES: W3C. January 2009.
  5. ↑ "foaf+ssl: creating a web of trust without key signing parties". Sun Microsystems.
  6. ↑ Gamble, Matthew; Goble, Carole (April 2010), "Standing on the Shoulders of the Trusted Web: Trust, Scholarship and Linked Data", Proceedings of the WebSci10: Extending the Frontiers of Society On-Line

External links