3 ms·
> Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models? Of course not. In fact, bus
by csixty4 12y ago
> Well, the solutions offered then have failed, but did they systematically rule out all possible technologies and business models?
Of course not. In fact, business models were only considered tangentially in most cases because the general goal was to create an ecosystem of federated identity providers transacting over open protocols. Differentiation would come from the relationship between customers and their providers - charging for background checks to add extra confidence to third-party claims, for example. Or, by selling enterprises more secure identity claim brokers for their employees.
> One problem is username and password proliferation. Another is filling out the same information over and over, like phone number, email address, and so on. E-commerce sites will often not bother checking email addresses and not require accounts because unnecessary obstacles drive potential customers away.
I'd love to see the Digital Identity discussion revived, and between high-profile security breaches (Adobe, Target...) and the NSA, I think it might be time.
I know you don't have or necessarily want a preconceived idea of what a 3rd-party account/identity provider should be, but I encourage you to look at what's been done & discussed before.
Dick Hardt's keynote from the 2006 Identity 2.0 conference is entertaining and informative: https://www.youtube.com/watch?v=RrpajcAgR1E https://www.youtube.com/watch?v=RrpajcAgR1E - it's also the talk that got me hooked on Vanilla Stoli for a couple of years.
Kim Cameron's "Laws of Identity" were the cornerstone of the discussion back them. They outline a system of federation, user control & consent, and minimal disclosure. Cameron's site also has lot of information about CardSpace/InfoCards (the open standard) and his blog covers some more modern Identity systems from Microsoft: http://www.identityblog.com/stories/2004/12/09/thelaws.html http://www.identityblog.com/stories/2004/12/09/thelaws.html
Chris Love's 2007 post-mortem on OpenID and CardSpace: http://love2dev.com/#!article/The-Identity-Crisis--Are-CardSpace-and-OpenId-Viable- http://love2dev.com/#!article/The-Identity-Crisis--Are-CardS...
I guess it would also be good to look at tools like 1Password which can fill out registration forms and passwords already, and see why they haven't been adopted more widely.
- mtdewcmu 12y agoI plan to check those links out. Thanks. The web has every kind of site, covering every possible use case and degree of need for security, so I think there's a good chance that useful models are still out there waiting to be given a try.