Template:User committed identity
From Wikiversity
| Committed identity: {{{1}}} is a SHA-512 commitment to this user's real-life identity. |
Usage: {{User committed identity|hash string|hash function (optional - defaults to SHA-512)|background= (optional)|border=(optional)}}
Template loop detected: Template:Template doc page transcluded
| Similar templates at English sister projects [edit] | |||
|---|---|---|---|
 |
wpd | Wikipedia | User committed identity |
 |
cms | Commons | User committed identity |
 |
wbk | Wikibooks | User committed identity |
 |
wsp | Wikispecies | User committed identity |
 |
wvy | Wikiversity | User committed identity |
Contents |
[edit] Use
Start the combined usage page or the /doc page with the following:
<includeonly> {{Template doc page transcluded}}
</includeonly><noinclude>
{{template doc page viewed directly}}
</noinclude>
- or
<includeonly>{{Template doc page transcluded| ''pagename''<nowiki>}}
</includeonly><noinclude>
{{template doc page viewed directly}}
</noinclude>
Place at the top of a template documentation page (usually a "Template:Template name/doc" page) that is transcluded on the template's own page (Template:Template name). If the documentation page is not named "doc" and/or its transclusion is via another subpage (e.g. "Template:Template name/example"), use the second form of syntax above and replace pagename accordingly.
- alternatively, substitute the template in the documentation page, and make a manual link fixup (needed only for such common usage pages, where {{BASEPAGENAME}} varies).
[edit] See also
- {{Interwikitmp-grp}}
- the companion template {{Template doc page viewed directly}}
- the companion sample template {{sample}}
- {{Interwiki doc page pattern}} which when subst'ed, creates boilerplate text for a /doc page including the proper calls to the other two.
- Note: All four add tagged pages properly to Category:Template documentation
This template categorizes pages it is used on into Category:Wikipedians with committed identities.
[edit] What is this?
This template gives you a way to later prove that you are the person who was in control of your account on the day this template was placed. This is done by putting a secret key on your user page so that, in the event that your account is compromised, you can convince someone else that you are really the person behind your username.
[edit] Why?
The intended use of this template is to help in the hopefully unlikely event that your account is compromised. If you published the real-life identity of the person using your account (you), then that identity could be used to reestablish contact with that person if the account were compromised; keep in mind, in this scenario contact could not be established with you through your account, since it may be under the control of someone else. However, many Wikipedia users do not disclose their real-life identities, or disclose little enough of them that it may be difficult to establish their identity.
This is not a replacement for having a strong password, nor for registering an email address for your account. You should still do everything you can to prevent your account being compromised, including using a strong password and remembering to log yourself out when using a computer others may have access to. If you have one, it may also be helpful to post your PGP public key. But even with the best of precautions, your account could become compromised, for instance, via a trojan horse or a brute-force attack on your password. This is intended to be a last resort.
[edit] How
The idea is to use cryptographic hashes; you choose a secret string known only to yourself, put it through a one-way SHA function, and publish the result somewhere. As the result is a hash, nobody can easily work backwards from the hash to the secret string; hence, if you give the secret string to someone and they hash it and the hash turns out to be same as the one published, it is very strong evidence that the person giving the secret string is the same person who originally published it. An attacker compromising an account presumably would not know the secret string.
[edit] Choosing a good string
- Your string should not be easy to guess. If you haven't openly declared your real-life identity on Wikipedia, then any string specifying your real-life identity is a good string. If you have openly declared who you are, your string should specify more information that wouldn't be easy to guess. If your string is easy to guess, then the fact that you know the string may not be very persuasive.
- Your string should specify enough of your identity that, if the string were revealed, you could unambiguously prove you match that identity. For instance, your string could include a telephone number or email address at which you can be reached.
- Try not to choose a string that represents your identity that could go completely out of date. So, for instance, it may be bad to choose a string that specifies only your telephone number as your number might change.
- If you want to change your string, do so, but keep track of all your old secret strings. It is best to reveal all of them if you ever want to confirm your identity, as this will establish that you are the same person who used your account from the first moment the committed identity was published.
- Your string should not be short: at least 15 characters. A dedicated attacker could, by brute force, try strings until they find your secret string, but if your string is long enough, that attack would take too long to be practical. If your string is at least 15 characters long, there are around 1027 strings of that length, or a thousand trillion trillion (and that's just counting alphanumeric strings with spaces).
[edit] Getting the hash
Be sure to note the exact string you enter into the form, in case you need to use it later. It is important that this string be both easily remembered exactly by you and hard to guess by any intruder - if an intruder knows the secret string, then this is useless. One's username is public and guessable; one's password is not a good choice either, as in the event of a compromised account, the password may have been guessed.
[edit] SHA-512 and other hash functions
On unixlike systems the sha224sum, sha256sum, sha384sum, and sha512sum programs are provided in the GNU Core Utilities; it is recommended that SHA-512 be used, as recent cryptographic research has cast doubt on the longterm viability of using SHA-1. You can use the tools at http://www.johnmaguire.us/tools/hashcalc/ to calculate the hash for a number of different hash functions. You would then use {{User committed identity|output|hash function}} The template defaults to SHA-512 if the hash function parameter is omitted. All caveat's still apply, but this allows for use of hash functions that may be more robust than SHA-1.
[edit] SHA-1
On unixlike systems, the command sha1sum can also be used to generate SHA1 checksums. If you do not have access to the GNU coreutils or GnuPG, you can go to this site, and enter in the text box a string that specifies your real-life identity, then click "calculate hash". Then put {{User committed identity|output|SHA-1}} on your user page, where output is the value appearing in the "SHA-1 hash:" box after the hash is calculated.
[edit] Using
To make use of your committed identity to someone and prove you are the same person who originally controlled the account, give a trusted user the exact secret string you originally entered into the box. They can then compute the appropriate hash of that same string and verify that it is the same result and that you are who you say you are.
Once you've established your identity, and set up a new account or regained control of the original account, you'll probably want to create a new hash as now someone (possibly multiple someones depending on who and how you told the secret string to) else knows the secret string.
