< Back to Moosecamp2007

Michael Stewart:

A panel featuring Eve Maler of Sun and Weston Triemstra and Johnny Bufu of SXIP and Boris Mann of Bryght.  Bring your curiosity and questions about digital identity.

Eve Maler:

A discussion about the nature of digital identity/ies, technologies that help make your identity portable when using web applications (such as OpenID and SAML), and implications for your privacy/anonymity. Is it sufficient to say that "On the Internet nobody knows you're a dog, but it's okay to know that you're the same dog"?

Boris Mann:

• 10 seconds to identity enabling your own domain / blog.
• so we've got identity: now what? building trust and other layers

Weston Triemstra:

A condensed intro to Identity:

• What is 'Identity'?
• Why all the fuss about Identity?
• Why should I care about OpenID?
• How can I get started using Identity?

notes from the event:

Eve Maler, Boris Mann, Johnny Bufu, Michael Stewart

Eve Maler starts with

actors

•   person with an identity
•   hardware intermediary (computer, phone, whatever) 
  •   these two become an identity wielding entity
•   Identity Provider (somewhere that identity data is stored)
•   Relying Party (something that wants to use identity data which is stored somewhere)

Information is exchanged between the actors regarding identity.

there can be more than one identity provider

there can be more than one relying party involved in any transaction

Currently identities are independent wherever they are stored. Usually relying parties are also identity providers for their own silo, their own application.

to be continued...

[Eve here.  I had written a few notes prior to the session, which I'll provide here for what they're worth.  I didn't get to all the points.]

Here are some interesting identity problems.

• Explosion of accounts on the web - we raised hands to show how many. Most people had several from work and personal sources. I have about 400!
  • Single sign-on is a technique/technology that can help ease the pain, by letting you log in once and "reuse" it at multiple sites.
  • Attributes (think of them as "form fields") might also get exchanged across the sites along with authentication info.
  • I think this is where I drew the person wielding an identity, the identity provider, and the website ("service provider") that relies on identity data about you from the identity provider.

• Centralization of identity down to a single account - this would be easier than 400 accounts, but gives a lot of power to the holder of that one identity.
  • This is why people had a problem with Microsoft's Passport, and why they're suspicious of national ID card systems.
  • The question is how to empower people with choices and control over their own identity information.
• Distributing identity info across the network in the first place! - keeping information within a single domain is a lot easier for companies and organizations to manage.
  • But this limits the interesting scenarios, such as Shibboleth, where a group of universities can share the online research materials of one university on the strength of student logins from the others.
  • Nor can this account for identity-enabled mashups, like:
    • My band accessing raw photos and tunes in the process of making a video montage
    • A startup in stealth mode working on company content in a CMS, with the three founding employees, a board, and some lawyers getting controlled access
  • But distribution of identity info around the web can lead to leakage and malicious access (e.g., through phishing)
• Dealing with the multiple accounts that are likely to remain in our lives - even if many accounts eventually accept something like an OpenID login, some won't.
  • This is where the notion of account linking comes in.
  • We already see this in "proprietary" fashion, such as when Flickr got bought by Yahoo!, or Blogger got bought by Google, and we've been asked to federate the old account with the new one by doing some setup: logging into both in rapid succession to form the link.
• Privacy and anonymity - despite some people's willingness to share their identifier (such as an OpenID) and other attributes about them "in the clear".
  • Some scenarios require anonymity, such as blowing the whistle at work.
  • Sometimes regulations require it, such as around the sharing of medical records or political affiliations.
  • There's a technique called pseudonyms that's frequently used to foster anonymity - instead of your real identifier, an opaque handle gets shared across.
  • "From now on, your Delta Tau Chi name shall be...Flounder!"
• Trust - the web can be tricksy; how can you, your browser or other client device, your identity providers, and your service providers all be sure they're dealing with someone on the up-and-up?
  • This is partially a matter of technology (like authenticating to each other, and secure online channels) and partially a matter of policy (such as whether a site that's just been handed your shipping address has the right to use it to stalk you).
• Ease of use - many things must go right on the web for identity information to be distributed properly and safely, and the human factor is important.
  • One way of making an online system easy to use is to allow you to set it up ahead of time to do things on your behalf silently.
  • We'd be driven nuts if it weren't an option to set up repeating online payments for anything!
  • Sometimes ease of use requires the system to work when you can't be available, e.g., the classic "break glass" scenario: You're passed out in a foreign emergency room and a doctor needs access to your records.

There are a number of exciting identity technologies on the scene that address these problems in various ways.

• SAML and Liberty Web Services standards have been around the longest.
  • Security Assertion Markup Language
  • Liberty Identity Web Services Framework, or ID-WSF
  • These cover a variety of scenarios, like single sign-on, single logout from multiple sites all at once, linking multiple existing accounts, and sharing attributes between sites (with or without human intervention).
  • They're designed to be able to handle "industrial-strength" security and privacy settings.
    • Typically this requires setting up a "circle of trust" ahead of time, which can be heavyweight because it usually involves lawyers!
    • But ProtectNetwork.com is an example of a very lightweight SAML-based identity provider that doesn't require this.
  • You might be using it and not knowing it (lots of governments, universities, banks, and the like use it under the covers).
• OpenID specification is new and fast-growing.
  • It provides a single sign-on solution for a very lightweight Web 2.0-like scenario.
  • It's very easy for websites to roll out support.
• CardSpace from Microsoft is focused on managing identities better and safer on your client device.
  • It's an authentication mechanism that, people think, can be used with a variety of single sign-on systems including those mentioned above.
  • This is likely to take some study and work.

< Back to Moosecamp2007