Tour




An Illustrated Example

Let's look at two sample FindMeOn badges in detail…

First, we'll look at the 'Flash' part- its what users see, and what handles all of the metrics reporting

FindMeOn.com

<embed src="http://synstat.findmeon.com/670d2d3837cad116ca4aba0c24a1c441/v1/badge.swf" type="application/x-shockwave-flash" width="180" height="150" FlashVars="fmo=670d2d3837cad116ca4aba0c24a1c441"></embed>

RoadSound.com

<embed src="http://synstat.findmeon.com/c8454dc53d20c71e09192244ca7bee96/v1/interactive.swf" type="application/x-shockwave-flash" width="180" height="150" FlashVars="fmo=c8454dc53d20c71e09192244ca7bee96"></embed>

As you can see, the only difference between the two is the part that reads: 'com/STUFF/v1' and 'fmo=STUFF' .

The 'STUFF' is just a unique ID that FindMeOn.com randomly assigned to your item for our own tracking, and to give you per-identity broadcast control. Each item under your account is completely different from all the others.

FindMeOn.com doesn't make you use our badges with the unique IDs -- you're more than welcome to use our service to create just the open standard portion. The open standard and unique IDs are completely independent of one another.

The unique FindMeOn.com IDs just exist to let us manage your items remotely , syndicate text and links for you on a per-id basis -- and to create multiple id repositories that are isolated from one another other. We wanted to use the signature value, but there was the slightest most improbable (yet legitimate) chance of two things having the same value, so we decided against it.

Now we'll look at the Open Standard part. It's usually invisible, but its the most important bit.

FindMeOn.com
<span class="findmeon">
	<span class="Spec" title="http://findmeon.org/spec/0_09"/>
	<span class="SignedInfo" title="resource;http://findmeon.com|type;url|subtype;business|attributes;|timestamp;2006-08-22 03:42:51" />
	<span class="Signature">
		<span class="SignatureValue" title="CObsDW/5V10MfqQyLCNG0gQCBJ8tv93/pxnremok65qX+EX4zCwdOxnG3rBsT5zMtRfSHW/dEpB8
dCuRQ/3swZGhsASxk48AriB7+WsB2F7w7JTSMFJ0Qs8WoHVlS8g5A9tDU51DbrE+O62XCIrQTqcg
Ly1funv/qdCwG8QYOvA="/>
		<span class="KeyInfo" title="-----BEGIN RSA PUBLIC KEY-----
MIGJAoGBALsdpp1Uux5EBTUc0HISggUhwpYAM9IEhZs4kkfnBSzm8u2HEit2lAXk
X0YU2D8jiH5dI3ZsOCle0GRLpKalaysmVpuAi07CvwkTr94c3z84P4sFYWiGztW2
iVQyfh2YjQLvRHtdBWujeXXvaR46oAKQnpsTYdFpq6QhSMrhF6gnAgMBAAE=
-----END RSA PUBLIC KEY-----"/>
	</span>
	<a class="SeeAlso" href="http://findmeon.com/findmeon/670d2d3837cad116ca4aba0c24a1c441" rel="repository me"/>
</span>
RoadSound.com
<span class="findmeon">
	<span class="Spec" title="http://findmeon.org/spec/0_09"/>
	<span class="SignedInfo" title="resource;http://roadsound.com|type;url|subtype;business|attributes;|timestamp;2006-08-22 03:42:58" />
	<span class="Signature">
		<span class="SignatureValue" title="AdknAUvlJfoopvwLid7bqdmUlBFRR7KhAiVIJHIZ//7Xf10NZl2slY0JSlvrD2PwOF8wx3R/vT4M
GsfF/7gEl488EBYBJhR/5dMFVwqv82zloYzTYxTEDN8eAHCdtYB+QrNVVreCMG5M/SekJCAxxQZS
n1LUwnNCOfkjWXpEj5Y="/>
	</span>
	<a class="SeeAlso" href="http://findmeon.com/findmeon/c8454dc53d20c71e09192244ca7bee96" rel="repository me"/>
</span>

There are a few important things you should notice about this bit of html:

  • The 'SignedInfo' and the 'SignatureValue' are completely different on each item.
  • The 'SeeAlso' parts both link to FindMeOn.com (and are optional), but they have two completely different URLs
  • The FindMeOn.com badge has a KeyInfo item-- which is optional -- but the RoadSound.com badge does not. The two badges are completely isolated from one another.

If you're not very computer literate, you might think that those two badges couldn't possibly be linked to one another. Neither one lists the other, and the only similar part- the key - is optional.

If you think that, you would be right and wrong. While the badges aren't linked to one another explicitly -- they're implicitly tied to a single public/private cryptographic key pairing.

The 'SignatureValue' on each badge is digital signature of the 'Signed Info' using the private key associated with the public key. The public key, and only the public key, can verify the signature created by the signed text.

The 'SeeAlso' part lists FindMeOn.com, and a unique page for that URL, as a repository -- that means that other items signed with the same key can be found there. If you want , you could list any URL you want as a repository-- or just link any 2 urls with one another by putting them each in a SeeAlso ( without listing them as a repository -- unless, of course, they are acting as one ).

SeeAlso just helps people who read your tags link sites together-- and it completely optional. Using FindMeOn.com, you get a virtual repository per-id, and can continually change what IDs see what, without updating any web pages.

If you don't want anyone to be able to link two sites together, then omit the SeeAlso tag, or use FindMeOn.com and create a private repository. Then you can share your public key and a list of sites you want verified only with the people you want to know about them.

If thats not secure, open, or privacy minded enough for you, we'd be really interesting in knowing what your requisites are.

If you'd like to see an example of code that shows how you can verify keys yourself, just click here for a Perl example.



The Extended Tour