Identity turns inside out

Characters

• Kim Cameron, Microsoft

Conversation on phone

• Craig Burton, Himself
• Phil Windley, BYU, O'Reilly
• Drummond Reed, Cordance, Identity Commons
• Kaliya Hamlin, Identity Commons
• Owen Davis, Identity Commons
• Fen Labalme, CTO, 2idi. [email protected]
• Jamie Lewis, The Burton Group
• Doc Searls, Linux Journal, IT Garage
• Bryan Field-Elliot, SourceID
• Andre Durand, Ping Identity
• Marc Canter, Himself
• E.E.Kim
• Jon Udell — interaction scenarios ... see sxip

Organizations

• The Burton Group
• Shibboleth
• SourceID
• SocialPhysics.org who they are
• IdentityCommons

Vendors/Products

• Cordance
• PingID

Meetings

• Gillmor Gang program, December 31, 2004

Timelines

Kim's Laws:

(These) define the set of "objective" dynamics that constrain the definition of an identity system capable of being widely enough accepted that it can enable distributed computing on a universal scale.  It is essential that we change the identity conversation enough that its laws are no longer argued as "moral imperatives", but rather as explanations of dynamics which must be mastered to craft such a universal system. 

1. The Law of Control: 
   Technical identity systems MUST only reveal information identifying a user with the user's consent.  (Starts here...)\
2. The Law of Minimal Disclosure
   The solution which discloses the least identifying information is the most stable, long-term solution.  (Starts here...)
3. The Law of Fewest Parties
   Technical identity systems MUST be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.  (Starts here...)
4. The Law of Directed Identity
   A universal identity system MUST support both "omnidirectional" identifiers for use by public entities and "unidirectional" identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.   (Starts here...)
5. The Law of Pluralism: 
   A universal identity system MUST channel and enable the interworking of multiple identity technologies run by multiple identity providers.  (Starts here...)
   • A universal identity system MUST channel and enable the interworking of multiple identity technologies run by multiple identity providers.
   • It is this which will allow an identity ecology to emerge, evolve and self-organize.
   • Dave Winer's RSS is so powerful because it vehicles any content.  We need to see that identity itself will have several - perhaps many - contents, and yet these can be expressed in a metasystem. 
6. The Law of Human Integration: 
   The universal identity system MUST define the human user to be a component of the distributed system, integrated through unambiguous human-machine communications mechanisms offering protection against identity attacks.  (Starts here...)
   
7. The Seventh Law: The Law of Harmonious Contextual Autonomy
   Yada. (Starts here...)

   The full list.

   Craig's posts

   • The Fifth Law: Sun Spot Hot
   • Cross-platform identity metasystem--brilliant

   The law of pluralism is contrary to the laws of customer control. Let's be clear, the law of pluralism requires operating system independence--by definition. This means the Microsoft Identity Archtiect is calling for a system that is not necissarily Windows centric by design. This--of course--is the only way such a system can really work--but consider the implications.

   A cross platfrom identity metasystem is sun-spot hot and--with the other laws being discussed here--changes everything.

   Kim conversation:

   When do you ever want identity information given out about you, when you're not there? What is the use case where I want my identity informatino to be given out by a robot? It's when I'm doing somethig that I come into a context where in return for some benefit I want to give some personal information out.

   Can you give me some examples of cases when informatoin is given out when

   Where does this type of thinking come from? It comes from people who do servers. It's an "If all you have is a hammer, then everything looks like a nail" thing.

   With this Laws thing, I'm putting people at the center of the framework. People who don't believe that individuals belong in the center of identity can't really assail the position.

   I'm not saying that their technology isn't useful. but it has to be the person's, the individual's decision, about what identity information is right in a given context.

   It's a quetion of what serves what.