4 ms·

There were a lot of solutions to this in the early 2000s, the golden age of the digital identity ecosystem. I did my bachelor's thesis on the issues faced by a

by csixty4 12y ago

There were a lot of solutions to this in the early 2000s, the golden age of the digital identity ecosystem. I did my bachelor's thesis on the issues faced by a solution that respected Cameron's Laws of Identity in 2003, shortly before the whole scene died off. There were simple, streamlined solutions for this a decade ago. Nobody used them and many of them died. Some still exist out there like zombies. I was shocked to see inames.net is still out there. The example I usually bring up is Windows CardSpaces, which shipped with Windows as recently as Windows 7. It was easy for people to get conceptually. It was easy for site admins to implement. But it never went anywhere. When I talked to people about identity solutions like this, there were problems on both ends. From the user side, an identity solution needed to solve an obvious problem and/or be easier than the status quo. For many users, the status quo is to give out personal information freely and use the same username/password everywhere. Anything that adds choices or variety to the process is too much friction for little perceived benefit. Even if the actual process is simpler (clicking a card) than the status quo (filling out a form), there's a mental cost in adapting to something new. For site owners, there was the added difficulty of educating and supporting users about the new identity solutions. But, the real biggie was that they'd lose the ability to collect & sell all that personal data. That can be more profitable than advertising, and it's a revenue stream some sites can't live without.

mtdewcmu 12y ago
Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I don't have a preconceived idea of what a 3rd-party account system should do. It could be anywhere from the least amount that would get a webmaster to install it up to a full username and password. Somewhere in there must be something better than the status quo.
- csixty4 12y ago
  > Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? Of course not. In fact, business models were only considered tangentially in most cases because the general goal was to create an ecosystem of federated identity providers transacting over open protocols. Differentiation would come from the relationship between customers and their providers - charging for background checks to add extra confidence to third-party claims, for example. Or, by selling enterprises more secure identity claim brokers for their employees. > One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I'd love to see the Digital Identity discussion revived, and between high-profile security breaches (Adobe, Target...) and the NSA, I think it might be time. I know you don't have or necessarily want a preconceived idea of what a 3rd-party account/identity provider should be, but I encourage you to look at what's been done & discussed before. Dick Hardt's keynote from the 2006 Identity 2.0 conference is entertaining and informative: https://www.youtube.com/watch?v=RrpajcAgR1E https://www.youtube.com/watch?v=RrpajcAgR1E - it's also the talk that got me hooked on Vanilla Stoli for a couple of years. Kim Cameron's "Laws of Identity" were the cornerstone of the discussion back them. They outline a system of federation, user control & consent, and minimal disclosure. Cameron's site also has lot of information about CardSpace/InfoCards (the open standard) and his blog covers some more modern Identity systems from Microsoft: http://www.identityblog.com/stories/2004/12/09/thelaws.html http://www.identityblog.com/stories/2004/12/09/thelaws.html Chris Love's 2007 post-mortem on OpenID and CardSpace: http://love2dev.com/#!article/The-Identity-Crisis--Are-CardSpace-and-OpenId-Viable- http://love2dev.com/#!article/The-Identity-Crisis--Are-CardS... I guess it would also be good to look at tools like 1Password which can fill out registration forms and passwords already, and see why they haven't been adopted more widely.
  - mtdewcmu 12y ago
    I plan to check those links out. Thanks. The web has every kind of site, covering every possible use case and degree of need for security, so I think there's a good chance that useful models are still out there waiting to be given a try.

by csixty4 12y ago

mtdewcmu 12y ago

Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I don't have a preconceived idea of what a 3rd-party account system should do. It could be anywhere from the least amount that would get a webmaster to install it up to a full username and password. Somewhere in there must be something better than the status quo.

csixty4 12y ago
> Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? Of course not. In fact, business models were only considered tangentially in most cases because the general goal was to create an ecosystem of federated identity providers transacting over open protocols. Differentiation would come from the relationship between customers and their providers - charging for background checks to add extra confidence to third-party claims, for example. Or, by selling enterprises more secure identity claim brokers for their employees. > One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away. I'd love to see the Digital Identity discussion revived, and between high-profile security breaches (Adobe, Target...) and the NSA, I think it might be time. I know you don't have or necessarily want a preconceived idea of what a 3rd-party account/identity provider should be, but I encourage you to look at what's been done & discussed before. Dick Hardt's keynote from the 2006 Identity 2.0 conference is entertaining and informative: https://www.youtube.com/watch?v=RrpajcAgR1E https://www.youtube.com/watch?v=RrpajcAgR1E - it's also the talk that got me hooked on Vanilla Stoli for a couple of years. Kim Cameron's "Laws of Identity" were the cornerstone of the discussion back them. They outline a system of federation, user control & consent, and minimal disclosure. Cameron's site also has lot of information about CardSpace/InfoCards (the open standard) and his blog covers some more modern Identity systems from Microsoft: http://www.identityblog.com/stories/2004/12/09/thelaws.html http://www.identityblog.com/stories/2004/12/09/thelaws.html Chris Love's 2007 post-mortem on OpenID and CardSpace: http://love2dev.com/#!article/The-Identity-Crisis--Are-CardSpace-and-OpenId-Viable- http://love2dev.com/#!article/The-Identity-Crisis--Are-CardS... I guess it would also be good to look at tools like 1Password which can fill out registration forms and passwords already, and see why they haven't been adopted more widely.
- mtdewcmu 12y ago
  I plan to check those links out. Thanks. The web has every kind of site, covering every possible use case and degree of need for security, so I think there's a good chance that useful models are still out there waiting to be given a try.