Joe Andrieu – joeandrieu.com
type: channel
description: My personal space
date: 2026-02-26T23:47:46Z
update period: hourly
update frequency: 1
update base: 2000-01-01T12:00+00:00
generator agent: https://wordpress.org/
items: Dehumanizing the Disconnected
items: Fighting for Consensus, Take 2
items: Fighting for Consensus at the W3C
items: A great conversation about #GoodID
items: Aadhaar: digital identity writ large in India
items: How Identity Can Enable A People-Centered Internet
items: Ten Years Later
items: Speaking of Identity
items: Detail is the enemy
items: The Moral Burden of the State

Dehumanizing the Disconnected
type: item
creator: Joe Andrieu
date: 2026-02-13T16:29:31Z
subject: privacy
subject: Technology
subject: Uncategorized
subject: digital fiduciary
subject: freedom
subject: humanity
subject: Identity
subject: realeyes
subject: uniqueness
subject: world
subject: worldcoin
subject: worldid
description: Last week, the Credentials Community Group of the World Wide Web Consortium hosted Scott Jones, sharing his company’s work on Client-side Biometric Authentication and Identity Verification. https://www.w3.org/events/meetings/6c106024-7f5f-4297-972b-18af6432aaef/20260203T120000/ He said a lot of smart things about his company, Realeyes https://realeyes.ai/, and … Continue reading →
encoded: Last week, the Credentials Community Group of the World Wide Web Consortium hosted Scott Jones, sharing his company’s work on Client-side Biometric Authentication and Identity Verification. https://www.w3.org/events/meetings/6c106024-7f5f-4297-972b-18af6432aaef/20260203T120000/ <img fetchpriority="high" decoding="async" width="382" height="132" src="https://blog.joeandrieu.com/wp-content/uploads/2026/02/verifeye.png" alt="VerifEye Powered by Realeyes" class="wp-image-1486" style="aspect-ratio:2.8941636083816737;width:301px;height:auto" srcset="https://blog.joeandrieu.com/wp-content/uploads/2026/02/verifeye.png 382w, https://blog.joeandrieu.com/wp-content/uploads/2026/02/verifeye-300x104.png 300w" sizes="(max-width: 382px) 100vw, 382px" /> He said a lot of smart things about his company, Realeyes https://realeyes.ai/, and their VerifEye offering. They are a leader in using AI and advanced biometrics for identity verification. I appreciated his discussion of how they are using real technology to improve the quality and privacy of identity assurance. In particular, I appreciate the progress towards client-side biometric authentication, which may prove a long term best-of-class approach to securing our digital identities without creating a panopticon. However, there is a fundamental flaw in their approach that deserves attention. Surprisingly, it is one that Dr Seuss’s Yertle the Turtle might have found familiar. At the end of the day, after all the privacy-engineering on the front end, Realeyes maintains their own uniqueness database. To their credit, they are refreshingly candid about charging for access. They hope to create a global database of who is human and then charge to query that database. It’s a straightforward business model that helps us better understand how such a system might be abused or otherwise cause harm. This vendor-controlled uniqueness database is the problem. Worldcoin and World <img decoding="async" width="150" height="150" src="https://blog.jo…

Fighting for Consensus, Take 2
type: item
creator: Joe Andrieu
date: 2023-09-08T21:34:03Z
subject: Uncategorized
description: In April, I appealed a decision by the W3C Chairs to place DID Methods in scope in the next DID WG Charter. That appeal was ignored and the charter advanced to AC Review. This is our Formal Objection to that … Continue reading →
encoded: In April, I appealed a decision by the W3C Chairs to place DID Methods in scope in the next DID WG Charter. That appeal was ignored and the charter advanced to AC Review. This is our Formal Objection to that charter. We oppose this charter on several grounds. Process Collaboration Technical Fundamentals Interoperability Goals PROCESS We stand by our appeal (https://blog.joeandrieu.com/2023/04/12/fighting-for-consensus-at-the-w3c/), which we feel was improperly handled. The Process rules, about consensus, appeals, and Formal Objections, in our opinion, were ignored. The incident (and the appeal) were filed under Process 2021; the current process is Process 2023. Staff’s response meets the requirements of neither Process. Since Philippe Le Hegaret cited Process 2023 in his response to my appeal, let’s look at what Process 2023 requires. Process 2023 requires Groups to formally address issues with a response that includes a rationale for decisions that “a W3C reviewer would generally consider to be technically sound”. Neither Philippe Le Hegaret’s nor the Chairs’ responses met that standard. Philippe simply claimed that “this charter is the most acceptable for the majority of the group (an assessment that was confirmed by a recent poll); and that 2) the charter is not a WG deliverable, and consensus must be reached at the AC level anyway, so Joe’s argument should be raised during AC review, not prior to it.” Unfortunately, the cited poll did not even attempt to gauge consensus. It merely gauged the popularity of advancing the WG, without consideration of the multiple options under consideration by members of the group. Rather than attempting to establish a legitimate vote, Staff created a poll that, like a Politburo election, only offered one candidate to vote on, where, in fact, it should have been inquiring about any objections to best understand the proposal with the weakest objections, instead of blatantly attempting to rubber stamp the offending decision. More pro…

Fighting for Consensus at the W3C
type: item
creator: Joe Andrieu
date: 2023-04-12T22:19:05Z
subject: Uncategorized
description: I am formally appealing to the Director of the W3C to deny the decision by the DID WG Charter chairs to override dissent about the inclusion of DID methods in the scope of the next DID WG Charter, as embodied in part in the decision to merge PR#20 and PR#27 into the DID WG Charter. Enabling the DID WG to develop specific DID methods will actively undermine the work's fundamental goal of decentralization. Continue reading →
encoded: Fighting for Consensus at the World Wide Web Consortium (W3C) 5.5. Chair Decision and Group Decision Appeals When group participants believe that their concerns are not being duly considered by the group or the Chair, they may ask the Director (for representatives of a Member organization, via their Advisory Committee representative) to confirm or deny the decision. This is a Group Decision Appeal or a Chair Decision Appeal. The participants should also make their requests known to the Team Contact. The Team Contact must inform the Director when a group participant has raised concerns about due process. Any requests to the Director to confirm a decision must include a summary of the issue (whether technical or procedural), decision, and rationale for the objection. All counter-arguments, rationales, and decisions must be recorded. From “W3C Process Document” https://www.w3.org/2021/Process-20211102/ It’s unfortunate that I find myself formally appealing a decision by the W3C Decentralized Identifier Working Group (DID WG) chairs. Simply put, the decision was not made according to the applicable W3C Process, which requires seeking consensus through selecting proposals with the weakest technical objections. The decision to appeal was not made lightly. It will force into the public view a disagreement between parties who generally have high mutual regard and respect. I personally think the DID WG chairs are well-intentioned and doing their best to resolve the challenges of the underlying work. However, in this particular case, we have a failure to secure consensus and an unfortunate autocratic imposition of the chairs’ position on a group in significant dissent. I got involved in this particular stream of work after attending the first ID2020 and Rebooting the Web of Trust II after over ten years in the user-centric identity movement as championed by the Internet Identity Workshop and ProjectVRM. I became (and remain) an editor for Verifiable Credentials Use Cases and …

A great conversation about #GoodID
type: item
creator: Joe Andrieu
date: 2019-02-21T15:50:17Z
subject: Identity
subject: privacy
subject: regulatory
subject: Technology
subject: Uncategorized
subject: Caribou Digital
subject: Good ID
subject: GoodID
subject: Harvard Kennedy School
subject: Omidyar Network
subject: Policy
description: Identity can be a real pain to discuss. #GoodID turns about to be a great way to talk about the diverse needs of different stakeholders in digital identity, resulting in actionable plans to shift policy. Continue reading →
encoded: <img loading="lazy" decoding="async" src="https://blog.joeandrieu.com/wp-content/uploads/2019/02/dreamstimeextrasmall_77238067.jpg" alt="" class="wp-image-1395" width="281" height="187" srcset="https://blog.joeandrieu.com/wp-content/uploads/2019/02/dreamstimeextrasmall_77238067.jpg 480w, https://blog.joeandrieu.com/wp-content/uploads/2019/02/dreamstimeextrasmall_77238067-300x200.jpg 300w" sizes="auto, (max-width: 281px) 100vw, 281px" /> Ancient barbarian warrior or Gladiator ready to fight Identity can be a real pain to discuss. I’ve been to dozens of workshops and conferences over the last decade plus and the quality of engagement varies from exciting, enthusiastic progress to frustrating, disheartening dysfunction—even within the same event. So many of us bring our own ax to grind that even when we think we are in agreement, we can spend ridiculous amounts of time in rat holes and rabbit holes that just don’t go anywhere productive. Yet, identity matters. So we push on through, hoping to forge common ground and make headway against the seemingly intractable task of figuring out how identity should work in the digital age. So it is rare that I get to enjoy as productive a conversation about identity as I did earlier this month at Good ID: What’s policy got to do with it?, organized by the Omidyar Network, run by Caribou Digital, and held at the Shorenstein Center of the Harvard Kennedy School. It wasn’t a collaborative writing exercise like we host at Rebooting the Web of Trust. It wasn’t an unconference open space like we gather for at the Internet Identity Workshop. It wasn’t a trade conference with presentations and panels like we get at Know Identity. Nor was it a large scale summit bringing together the international community with technologists like ID2020. On the contrary, it was an intimate gathering of passionate and experienced individuals from diverse fields, first discussing what “Good ID” might mean and how policy can help us get there, then committing…

Aadhaar: digital identity writ large in India
type: item
creator: Joe Andrieu
date: 2017-11-16T18:30:02Z
subject: Functional Identity
subject: Identity
subject: Aadhaar
subject: IndiaStack
subject: PCI
subject: People Centered Internet
description: India has forged new ground in digital infrastructure with its IndiaStack [1] initiative and Aadhaar, the biometric identity system at its core. Aadhaar is the largest state-sponsored digital identity system in the world. With over 1.1 billion Indian residents enrolled, … Continue reading →
encoded: India has forged new ground in digital infrastructure with its IndiaStack [1] initiative and Aadhaar, the biometric identity system at its core. Aadhaar is the largest state-sponsored digital identity system in the world. With over 1.1 billion Indian residents enrolled, it is transforming the world’s second most populous nation from an underdeveloped state into an advanced digital society. It isn’t perfect, but its successes and failures offer important lessons in the opportunities and the pitfalls of national identity systems. Architecturally, Aadhaar is a voluntary, biometric-based identity proofing layer upon which additional services can be built. By design, it is as minimal as possible, enabling a single function: state-endorsed biometric authentication of individual Indian residents. It is one of five core IndiaStack applications, which together provide foundational digital services throughout India. The other four are eKYC – Digitize your KYC (Know Your Customer for bank account creation). UPI – Transfer money between bank accounts in India. Digilocker – Retrieve, Store & Share verified digital documents. eSign – Sign any document electronically. In addition to these government provided applications, registered companies can build apps on top of IndiaStack. In the words of its chief architect: Large scale social problems require “unbundling of the problem” and creation of “shared digital infra” as “public good” on top of which “innovative solutions” can be “assembled” to meet diverse contextual needs. –Pramod Varma, Chief Architect, Aadhaar At the 2017 ID2020 [2] summit, Pramod Varma put it this way: Aadhaar provides robust de-duplication so services can know definitively that people aren’t lying about their identity, such as filing double claims for benefits or other advantages. A set of open APIs, IndiaStack provides “digital infrastructure platforms as public good to allow solutions to be assembled by the ecosystem.” In other words, the five IndiaStack ser…

How Identity Can Enable A People-Centered Internet
type: item
creator: Joe Andrieu
date: 2017-08-25T14:36:40Z
subject: Uncategorized
description: Understanding Identity through Function This is the second of a regular column on Identity for the People Centered Internet. In the first column, I introduced the idea of Functional Identity as a way for ordinary people to discuss identity, with … Continue reading →
encoded: Understanding Identity through Function This is the second of a regular column on Identity for the People Centered Internet. In the first column, I introduced the idea of Functional Identity as a way for ordinary people to discuss identity, with this definition: Identity is how we keep track of people and things, and in turn, how they keep track of us. This article describes how we do that. An identity system is a collection of tools and techniques used to keep track of people and things. As individuals, we do this naturally, in our minds. We name things, then use names and distinguishing features to remember what we learn. We treat people differently based on their identity: treating our friends and family differently from strangers and known threats. Organizations create processes, software, and services to achieve similar ends. These identity systems are best understood in terms of how they function, which is the same way that identity has worked since the dawn of civilization. The goal of Functional Identity is to bridge the communication gap so business people, community leaders, and parents can talk with engineers and regulators, and together and we can make identity systems that work better for us all. Definitions In the diagrams below, the blue boxes are nouns and the red ovals are verbs – the building blocks for describing identity systems. We start with the simplest identity system, using three nouns and a verb: Subjects are entities—people or things—under consideration. Identifiers are labels which refer to entities. They are used to keep track of what we know about those entities. Attributes are what we know about people and things. They describe the state, appearance, or other qualities of an entity. Correlate means to associate attributes with particular entities, to associate what we know about someone with either an identifier in the system or a subject in question. Identity systems correlate subjects with attributes in two ways. First, attributes ar…

Ten Years Later
type: item
creator: Joe Andrieu
date: 2017-06-14T22:38:45Z
subject: Identity
subject: ProjectVRM
subject: Vendor Relationship Management
subject: GDPR
subject: IIW
subject: Personal Data Store
subject: User Driven
subject: User Driven Services
subject: VRM
description: Ten years ago I wrote a blog post that captured a key architectural insight at the core of VRM: putting the user at the center of integration not only improves the quality of services, it simplifies our systems. The article captured the gestalt of VRM and helped catalyze a range of conversations that still shape the VRM approach. Since then, we have seen a lot of progress. Here are a few standout examples. Continue reading →
encoded: Ten years ago I wrote a blog post that captured a key architectural insight at the core of VRM: putting the user at the center of integration not only improves the quality of services, it simplifies our systems. When we put the user at the center, and make them the point of integration, the entire system becomes simpler, more robust, more scalable, and more useful. The article captured the gestalt of VRM and helped catalyze a range of conversations that still shape the VRM approach. Since then, we have seen a lot of progress. Sometimes we proceeded in fits and starts and there were certainly failures along the way, including my own venture, SwitchBook. When I started pulling together my notes for this anniversary post, I was mildly surprised and delighted at how much real work got done and the real-world impact we’ve had. Here are a few VRMy developments in the last decade worth noting. Please chime in with a comment if you know of a good one to add to the list. Coming in December of that same year, OAuth kicked off a series of standard protocols for identity, attribute sharing, and permissions, including OAuth 2.0, OpenID Connect, and User Managed Access (now at 2.0). These efforts brought together the leading technology companies to collaboratively develop new standards that give individuals greater flexibility and control over data exchange between online services. Companies like Personal.com. (now TeamData), Digi.me, and Cozy Cloud shipped user-driven personal data stores. Software project HIE of One offers a personal data store that lets individuals manage our own healthcare data. In Europe, GDPR has ushered in a new wave of regulatory requirements and penalties driving companies and organizations to give individuals easier access to, greater control of, and more security in our personal data. JLINC Labs offers a provenance service layer that allows companies to quickly attain GDPR compliance for the right to erasure and data provenance by giving individuals di…

Speaking of Identity
type: item
creator: Joe Andrieu
date: 2017-06-12T20:33:02Z
subject: Identity
subject: Technology
subject: functional identity
description: Identity is one of the most important constructs of society. It’s also one of the hardest to discuss. It is how we keep track of people and things and, in turn, how they keep track of us. When we build identity systems without a core understanding of identity, we risk inadvertently compromising human dignity. Continue reading →
encoded: Identity is one of the most important constructs of society. It’s also one of the hardest to discuss. I’ve been in perhaps hundreds of conversations in over a dozen years about user-centric and digital identity. I’ve realized that many of our challenges in digital identity stem from two problems in these conversations. First, miscommunication; we often use the same words with different meanings. Second, we get distracted by compelling but unproductive discussions about different aspects of identity. In response, I’ve begun a conversation about how to talk about identity in a way that is both accessible and rigorous. I want to find a way to discuss identity that laypeople understand, without alienating technologists. Digital identity—like the rest of our Internet-enabled world—is scaling faster than society knows how to handle. If we don’t develop a simple way for experts to talk with regular people about both identity and its realization in digital identity, it will be nearly impossible to build an Internet identity layer that fully addresses the needs of a modern global society. One way or another, that identity layer is being built. I believe a better conversation will make a difference. Consider for a moment a slightly different way to think about identity: Functional Identity. If the approach feels off or triggers a reaction, please drop me a line at joe@legreq.com. If we are to discover how to talk about this simply and effectively, your response is a valuable part of the discourse. Reframing Identity Our framing of identity determines how we talk about it. The facets of identity are so rich that we each bring our own hot buttons and agendas to any discussion. Some engage from a philosophical perspective, others cultural. Some dive into political issues and others get meta-physical and spiritual. These different frames are valid aspects identity’s impact on our lives. Not just valid. Vital. They help answer the question of “Why?” Why it matters, why we should c…

Detail is the enemy
type: item
creator: Joe Andrieu
date: 2017-01-10T18:49:32Z
subject: Development
subject: Requirements Modeling
subject: detail
subject: focal use case
subject: Jira
subject: rigor
subject: use cases
subject: user stories
description: Rigor is your friend. When defining the requirements for a system, its best to avoid detail and focus on rigor instead. Endless prescriptive details are the bane of good requirements. What to do or not do. Features. Capabilities. Constraints. So … Continue reading →
encoded: Rigor is your friend. When defining the requirements for a system, its best to avoid detail and focus on rigor instead. Endless prescriptive details are the bane of good requirements. What to do or not do. Features. Capabilities. Constraints. So many things you can say that its hard to tell what to focus on. Too much detail prevents understanding rather than enabling it. I had a client once who believe their 250+ “user stories”, diligently and exhaustively captured in Jira, perfectly described the system we were to build. Unfortunately, no one else could see through the muddle to understand what we were supposed to do. Not her boss. Not the engineers. Not her peers in the organization. Understandably, she was frustrated when others said they don’t understand our priorities or even what the MVP (minimal viable product) actually is supposed to be. She had doubtless put hundreds, perhaps thousands of hours into capturing every detail that should be addressed as we built out the product. Her intention, diligence, and technical skill were all exemplary, and yet, the extensive Jira entries failed to do what she most needed them to do: help her collaborators understand the requirements of the product we were going to build together. In my experience, this is a common pattern, a perfectly natural result of product managers and engineers focusing on quantity and detail rather than rigor, clarity, and focus. Working together, we were able to build a consensus with the founder of the company (and our boss) about the #1 focal use case. That use case not only provided clarity about how engineers might choose between tradeoff in early development, it cemented understanding between the technical team and the founder about what capabilities and what work are most important to the near term success of the company. When we were able to focus on a single use case, we were able to answer–even as a temporary conclusion–questions that were preventing software development from moving ahea…

The Moral Burden of the State
type: item
creator: Joe Andrieu
date: 2015-10-10T19:45:59Z
subject: regulatory
subject: moral burden
subject: prison
subject: state
description: The moral burden of the state cannot be separated from it. Continue reading →
encoded: There are times when it is appropriate for the state to restrict our liberties. To detain us. To imprison us. Even to take human life. The constitution and the institutions of our republic imbue the state with the moral authority to restrict our liberties, subject to checks and balances that work to keep inevitable errors and excesses to a minimum. There is no time when it is appropriate to abrogate the moral obligation of the state and give corporations the role of restricting our liberties. Not because it is convenient. Not because it is cheaper. Corporations are not only free from the constitutional framework of the state, they are legally required to maximize shareholder value. They are structurally unable to place the moral needs of the state–or the individual or society–ahead of corporate interests. Institutions designed for profit cannot credibly wield the moral authority of the state. The moral burden of the state cannot be separated from it. Please consider signing Bernie Sander’s petition to end corporate prisons. It’s time to stop profiting from incarceration. https://go.berniesanders.com/page/s/private_prisons