Identity – joeandrieu.com
type: channel
description: My personal space
date: 2019-02-21T18:03:13Z
update period: hourly
update frequency: 1
update base: 2000-01-01T12:00+00:00
generator agent: https://wordpress.org/
items: A great conversation about #GoodID
items: Aadhaar: digital identity writ large in India
items: Ten Years Later
items: Speaking of Identity
items: User Driven Services: 9. Self-managed Identity
items: The Identity Quartet
items: Kynetx takes on Structured Browsing
items: R-cards “ah-hah!” at IIW
items: Bandit, Higgins, Open Source, Profit and Novell
items: Majority of Americans dislike unauthorized use of behavioral data

A great conversation about #GoodID
type: item
creator: Joe Andrieu
date: 2019-02-21T15:50:17Z
subject: Identity
subject: privacy
subject: regulatory
subject: Technology
subject: Uncategorized
subject: Caribou Digital
subject: Good ID
subject: GoodID
subject: Harvard Kennedy School
subject: Omidyar Network
subject: Policy
description: Identity can be a real pain to discuss. #GoodID turns about to be a great way to talk about the diverse needs of different stakeholders in digital identity, resulting in actionable plans to shift policy. Continue reading →
encoded: <img fetchpriority="high" decoding="async" src="https://blog.joeandrieu.com/wp-content/uploads/2019/02/dreamstimeextrasmall_77238067.jpg" alt="" class="wp-image-1395" width="281" height="187" srcset="https://blog.joeandrieu.com/wp-content/uploads/2019/02/dreamstimeextrasmall_77238067.jpg 480w, https://blog.joeandrieu.com/wp-content/uploads/2019/02/dreamstimeextrasmall_77238067-300x200.jpg 300w" sizes="(max-width: 281px) 100vw, 281px" /> Ancient barbarian warrior or Gladiator ready to fight Identity can be a real pain to discuss. I’ve been to dozens of workshops and conferences over the last decade plus and the quality of engagement varies from exciting, enthusiastic progress to frustrating, disheartening dysfunction—even within the same event. So many of us bring our own ax to grind that even when we think we are in agreement, we can spend ridiculous amounts of time in rat holes and rabbit holes that just don’t go anywhere productive. Yet, identity matters. So we push on through, hoping to forge common ground and make headway against the seemingly intractable task of figuring out how identity should work in the digital age. So it is rare that I get to enjoy as productive a conversation about identity as I did earlier this month at Good ID: What’s policy got to do with it?, organized by the Omidyar Network, run by Caribou Digital, and held at the Shorenstein Center of the Harvard Kennedy School. It wasn’t a collaborative writing exercise like we host at Rebooting the Web of Trust. It wasn’t an unconference open space like we gather for at the Internet Identity Workshop. It wasn’t a trade conference with presentations and panels like we get at Know Identity. Nor was it a large scale summit bringing together the international community with technologists like ID2020. On the contrary, it was an intimate gathering of passionate and experienced individuals from diverse fields, first discussing what “Good ID” might mean and how policy can help us get there, then committing…

Aadhaar: digital identity writ large in India
type: item
creator: Joe Andrieu
date: 2017-11-16T18:30:02Z
subject: Functional Identity
subject: Identity
subject: Aadhaar
subject: IndiaStack
subject: PCI
subject: People Centered Internet
description: India has forged new ground in digital infrastructure with its IndiaStack [1] initiative and Aadhaar, the biometric identity system at its core. Aadhaar is the largest state-sponsored digital identity system in the world. With over 1.1 billion Indian residents enrolled, … Continue reading →
encoded: India has forged new ground in digital infrastructure with its IndiaStack [1] initiative and Aadhaar, the biometric identity system at its core. Aadhaar is the largest state-sponsored digital identity system in the world. With over 1.1 billion Indian residents enrolled, it is transforming the world’s second most populous nation from an underdeveloped state into an advanced digital society. It isn’t perfect, but its successes and failures offer important lessons in the opportunities and the pitfalls of national identity systems. Architecturally, Aadhaar is a voluntary, biometric-based identity proofing layer upon which additional services can be built. By design, it is as minimal as possible, enabling a single function: state-endorsed biometric authentication of individual Indian residents. It is one of five core IndiaStack applications, which together provide foundational digital services throughout India. The other four are eKYC – Digitize your KYC (Know Your Customer for bank account creation). UPI – Transfer money between bank accounts in India. Digilocker – Retrieve, Store & Share verified digital documents. eSign – Sign any document electronically. In addition to these government provided applications, registered companies can build apps on top of IndiaStack. In the words of its chief architect: Large scale social problems require “unbundling of the problem” and creation of “shared digital infra” as “public good” on top of which “innovative solutions” can be “assembled” to meet diverse contextual needs. –Pramod Varma, Chief Architect, Aadhaar At the 2017 ID2020 [2] summit, Pramod Varma put it this way: Aadhaar provides robust de-duplication so services can know definitively that people aren’t lying about their identity, such as filing double claims for benefits or other advantages. A set of open APIs, IndiaStack provides “digital infrastructure platforms as public good to allow solutions to be assembled by the ecosystem.” In other words, the five IndiaStack ser…

Ten Years Later
type: item
creator: Joe Andrieu
date: 2017-06-14T22:38:45Z
subject: Identity
subject: ProjectVRM
subject: Vendor Relationship Management
subject: GDPR
subject: IIW
subject: Personal Data Store
subject: User Driven
subject: User Driven Services
subject: VRM
description: Ten years ago I wrote a blog post that captured a key architectural insight at the core of VRM: putting the user at the center of integration not only improves the quality of services, it simplifies our systems. The article captured the gestalt of VRM and helped catalyze a range of conversations that still shape the VRM approach. Since then, we have seen a lot of progress. Here are a few standout examples. Continue reading →
encoded: Ten years ago I wrote a blog post that captured a key architectural insight at the core of VRM: putting the user at the center of integration not only improves the quality of services, it simplifies our systems. When we put the user at the center, and make them the point of integration, the entire system becomes simpler, more robust, more scalable, and more useful. The article captured the gestalt of VRM and helped catalyze a range of conversations that still shape the VRM approach. Since then, we have seen a lot of progress. Sometimes we proceeded in fits and starts and there were certainly failures along the way, including my own venture, SwitchBook. When I started pulling together my notes for this anniversary post, I was mildly surprised and delighted at how much real work got done and the real-world impact we’ve had. Here are a few VRMy developments in the last decade worth noting. Please chime in with a comment if you know of a good one to add to the list. Coming in December of that same year, OAuth kicked off a series of standard protocols for identity, attribute sharing, and permissions, including OAuth 2.0, OpenID Connect, and User Managed Access (now at 2.0). These efforts brought together the leading technology companies to collaboratively develop new standards that give individuals greater flexibility and control over data exchange between online services. Companies like Personal.com. (now TeamData), Digi.me, and Cozy Cloud shipped user-driven personal data stores. Software project HIE of One offers a personal data store that lets individuals manage our own healthcare data. In Europe, GDPR has ushered in a new wave of regulatory requirements and penalties driving companies and organizations to give individuals easier access to, greater control of, and more security in our personal data. JLINC Labs offers a provenance service layer that allows companies to quickly attain GDPR compliance for the right to erasure and data provenance by giving individuals di…

Speaking of Identity
type: item
creator: Joe Andrieu
date: 2017-06-12T20:33:02Z
subject: Identity
subject: Technology
subject: functional identity
description: Identity is one of the most important constructs of society. It’s also one of the hardest to discuss. It is how we keep track of people and things and, in turn, how they keep track of us. When we build identity systems without a core understanding of identity, we risk inadvertently compromising human dignity. Continue reading →
encoded: Identity is one of the most important constructs of society. It’s also one of the hardest to discuss. I’ve been in perhaps hundreds of conversations in over a dozen years about user-centric and digital identity. I’ve realized that many of our challenges in digital identity stem from two problems in these conversations. First, miscommunication; we often use the same words with different meanings. Second, we get distracted by compelling but unproductive discussions about different aspects of identity. In response, I’ve begun a conversation about how to talk about identity in a way that is both accessible and rigorous. I want to find a way to discuss identity that laypeople understand, without alienating technologists. Digital identity—like the rest of our Internet-enabled world—is scaling faster than society knows how to handle. If we don’t develop a simple way for experts to talk with regular people about both identity and its realization in digital identity, it will be nearly impossible to build an Internet identity layer that fully addresses the needs of a modern global society. One way or another, that identity layer is being built. I believe a better conversation will make a difference. Consider for a moment a slightly different way to think about identity: Functional Identity. If the approach feels off or triggers a reaction, please drop me a line at joe@legreq.com. If we are to discover how to talk about this simply and effectively, your response is a valuable part of the discourse. Reframing Identity Our framing of identity determines how we talk about it. The facets of identity are so rich that we each bring our own hot buttons and agendas to any discussion. Some engage from a philosophical perspective, others cultural. Some dive into political issues and others get meta-physical and spiritual. These different frames are valid aspects identity’s impact on our lives. Not just valid. Vital. They help answer the question of “Why?” Why it matters, why we should c…

User Driven Services: 9. Self-managed Identity
type: item
creator: Joe Andrieu
date: 2009-05-13T09:54:08Z
subject: Identity
subject: User Driven
subject: User Driven Services
subject: information cards
subject: OpenID
description: 9. Self-managed Identity User Driven Services let users manage their own online identity. Unless we control our identity online, we risk unnecessary exposure to identity theft and unwanted correlation of online activity. At the same time, online services increase the … Continue reading →
encoded: 9. Self-managed Identity User Driven Services let users manage their own online identity. <img loading="lazy" decoding="async" class="alignright size-full wp-image-587" title="Name tag" src="https://blog.joeandrieu.com/wp-content/uploads/2009/05/dreamstime_4473313hello-my-name-iscropped.jpg" alt="Name tag" width="288" height="196" srcset="https://blog.joeandrieu.com/wp-content/uploads/2009/05/dreamstime_4473313hello-my-name-iscropped.jpg 480w, https://blog.joeandrieu.com/wp-content/uploads/2009/05/dreamstime_4473313hello-my-name-iscropped-300x203.jpg 300w" sizes="auto, (max-width: 288px) 100vw, 288px" />Unless we control our identity online, we risk unnecessary exposure to identity theft and unwanted correlation of online activity. At the same time, online services increase the risk of attacks when using the same identifier for multiple functions. User Driven Services allow users to be in maximum control of their identity by distinguishing between the four different types of identifiers used online: Authentication IDs Presentation IDs Reference IDs Internal IDs Users should be able choose their own third-party identity service and have complete control over the three external identifiers used by any User Driven Service: their authentication IDs, their reference IDs, and their presentation IDs. The internal ids relating these external identifiers should never be exposed. Identity Providers should operate in non-correlation modes—so that different services providers automatically receive different authentication tokens, and all presentation IDs should be hand selected by the user for each service whenever possible. The ideal service will enable intentional correlation only upon user directive, allowing individuals to claim blog posts, social profiles, and microblogging accounts as their own, after initially anonymous or psuedonymous use. Services are also more flexible when they allow users to use multiple distinct identifiers within a given class, e.g., having more t…

The Identity Quartet
type: item
creator: Joe Andrieu
date: 2009-03-12T16:49:44Z
subject: Identity
subject: User Driven
subject: User Driven Services
subject: identity quartet
subject: IIW
subject: IIW2008b
subject: information cards
subject: Internet Identity Workshop
subject: Kim Cameron
subject: non-correlation
subject: OpenID
subject: Randy Farmer
subject: Seven Laws of Identity
subject: User-centric Identity
subject: user-driven identity
description: A functional model for best practice Identity implementations. The Identity Quartet is a framework for online services that allows users to express their Identity on their own terms. When I use the term “Identity”, I refer to the set of … Continue reading →
encoded: A functional model for best practice Identity implementations. The Identity Quartet is a framework for online services that allows users to express their Identity on their own terms. When I use the term “Identity”, I refer to the set of identifiers used in reference to users in online services. At the December 2008 Internet Identity Workshop, Randy Farmer introduced what he called the “Tripartite Model of Identity.” He presented a pattern distilled from years of groundbreaking work building virtual communities. This article is a write up of a four component model based on Randy’s initial concept. I also build on the ideas discussed at the IIW session on Non-correlatable IDs with OpenID. The Quartet In online systems, we use Identity in four roles, using four potentially distinct identifiers. Each of those four will be present in any system that allows users to login, present themselves online, and receive incoming services. Often, systems use the same identifier to fulfill multiple roles. However, there are good reasons that these identifiers should be managed separately, especially across organizational boundaries. The four identifiers are: Authentication IDs Presentation IDs Reference IDs Internal IDs Authentication IDs To access privileged services, users must present an identifier to claim their right to that service. Common identifiers include session IDs, cryptographic tokens, and usernames. Usernames are probably the most common identifier for logging into services. Paired with a password for authentication, this is a cornerstone of how we use identity to gain access to privileged services. That access authorization typically persists without logging in again through the use of a session ID. In a user-centric context we can separate the authentication ID used at a Relying Party with that used at the Identity Provider, allowing for directed identity as described by Kim Cameron in his Seven Laws of Identity. In a capability-based authentication regime, the iden…

Kynetx takes on Structured Browsing
type: item
creator: Joe Andrieu
date: 2009-02-08T07:47:48Z
subject: Identity
subject: Intention Economy
subject: Personal Data Store
subject: ProjectVRM
subject: User Driven Search
subject: Vendor Relationship Management
subject: ad blockers
subject: Adaptive Blue
subject: data rights management
subject: Doc Searls
subject: Glue
subject: information cards
subject: kynetx
subject: MyDex
subject: open source
subject: open standards
subject: OpenID
subject: Phil Windley
subject: privacy
subject: r-button
subject: rbutton
subject: relationship services
subject: search map
subject: Skype
subject: structured browsing
subject: SwitchBook
subject: User Driven Services
subject: VRM
subject: web augmentation
subject: Yahoo Toolbar
description: Doc Searls recently brought my attention to a White Paper by Phil Windley, about his company, Kynetx. It does a good job explaining the thinking behind their architecture, and raises some questions that, for me, challenge some underlying assumptions and … Continue reading →
encoded: Doc Searls recently brought my attention to a White Paper by Phil Windley, about his company, Kynetx. It does a good job explaining the thinking behind their architecture, and raises some questions that, for me, challenge some underlying assumptions and business choices. Problem Domain The distributed nature of the web is a big part of its power–nobody needs to ask permission from a central authority to use it or create with it. However, that disaggregation limits the cohesion for sophisticated uses, leaving users to hobble together ad-hoc mash-ups of value from multiple, diverse service providers. For example, the average travel planner spends 29 days from their first query to their first purchase. No tool I know of facilitates that entire process effectively. Solving this problem in a general way—while retaining the authority of the individual and the flexibility of open systems—is perhaps the greatest opportunity for VRM. The personal data store and VRM relationship services are two prongs of an architectural shift for enabling this kind of aggregation while remaining open. Once you put the user in the driver’s seat, with coherent controls over the flow and the data, the experience can integrate around the user, even as they drive anywhere on the Internet. Solution Kynetx’s solution is built on one primary capability: A rules engine (and language) for contextual customization based on strong identity-based claims, using the user-centric Identity of Information Cards. This puts Kynetx squarely in the web augmentation service business. Adaptive Blue (and their Glue product) is perhaps the most sophisticated approach to this space, but Yahoo’s Toolbar also augments web pages, as does Skype (putting its SkypOut button on any phone # it recognizes), and the granddaddies of all web-augmentation services are the ad blocker plug-ins that remove banner ads on websites. I distinguish web augmentation from web media enhancements, like PDF and Flash and Java, in that the lat…

R-cards “ah-hah!” at IIW
type: item
creator: Joe Andrieu
date: 2008-06-08T02:22:40Z
subject: Identity
subject: Personal Data Store
subject: icards
subject: IIW2008a
subject: information cards
subject: r-cards
subject: rcards
subject: relationship cards
subject: VRM
description: At last month’s Internet Identity Workshop and the subsequent DataSharing Summit, Markus S and Drummond Reed unpacked several ideas about r-cards, which, to a certain extent, are an evolution of the Information Card at the heart of CardSpace. Going into … Continue reading →
encoded: At last month’s Internet Identity Workshop and the subsequent DataSharing Summit, Markus S and Drummond Reed unpacked several ideas about r-cards, which, to a certain extent, are an evolution of the Information Card at the heart of CardSpace. Going into IIW, I understood r-cards simply as a hybrid of InfoCard’s managed and personal card models. Managed cards are issued by another party–all the data associated/transmitted with that card is controlled by that managing party, while personal cards are self-asserted, allowing individuals to serve as their own card provider, controlling all of the associated data. R-cards then, allow a managing party to co-control a card with the user–with some data controlled by the managing party and some controlled by the user. However, during the IIW demo of r-card, I had an epiphany about how powerful the r-card is, once we actually allow the user to manage the personal claims through multiple, dereferenceable links. <o></o>One issue that came up during the demo was that if the “personal” side of the r-card is manually entered claims, such as contact information, then the user is creating a management nightmare: duplicate claims would need to be entered and maintained across many different r-cards. The more r-cards, the worse the problem. The “obvious” solution discussed at the session was to allow the user to specify specific claims that are served by other IdPs, such as a Personal Address Manager. And for completeness sake, let’s note that such claims could be mashed up from multiple other IdPs, not just a single one. Thus, any number of claims from a particular IdP could act as a sort of sub-card, combining with other subcards at presentation time. The net result of this is a realization that that perhaps the most interesting thing about r-cards is their use as dynamic cards or aggregate cards or mashup identity cards. That’s pretty cool in itself. However, it also struck me that this also potentially fixes usability problems arou…

Bandit, Higgins, Open Source, Profit and Novell
type: item
creator: Joe Andrieu
date: 2008-05-11T19:51:21Z
subject: Identity
subject: Bandit
subject: Dale Olds
subject: Higgins
subject: Identity Meta-System
subject: Kim Cameron
subject: Microsoft
subject: Novell
subject: open source
subject: User-centric Identity
description: At EIC2008 last month, Dale Olds of Novell’s Bandit Project gave me a few minutes and some insight into how Novell (and others) are mixing open source with proprietary software to architect a whole new Identity paradigm online. I’ve been … Continue reading →
encoded: At EIC2008 last month, Dale Olds of Novell’s Bandit Project gave me a few minutes and some insight into how Novell (and others) are mixing open source with proprietary software to architect a whole new Identity paradigm online. I’ve been following the user-centric Identity movement ever since Doc Searls talked me into attending IIW2006b, an unconference. EIC is a classic Enterprise technology sales conference on identity management. The two events couldn’t be more different, even though both have excellent content and are focused on Identity. EIC was all about big business selling to each other, while IIW is all about engineers making user-centric Identity work. Identity? A lot of you are familiar with the term, but for those who might not know what I mean, I’m talking about how people authenticate themselves for access to online systems. Traditionally based on usernames and passwords, online Identity presents a host of problems, not the least of which is that an individual may have dozens or even hundreds of different usernames and passwords, one for each new web service or corporate LAN accessed. This proliferation is itself a security risk–as people reuse passwords despite the best efforts of zealous IT gurus everywhere. It is also an information management nightmare: how are we supposed to remember all of that? Which reinforces the problem of reused passwords and unfortunately typically insecure password reset. Today’s identity management software provides solutions to this problem, largely through federation and user-centric Identity. In short, federation is how corporate IT systems rely on other corporate systems–provided by other departments or even other companies–to authenticate your identity and share information about you. It can be used for authentication, or as in the case of FaceBook’s Beacon, it can be used to pass on highly sensitive personal data. (Blockbuster is now in a lawsuit over this, which I expect they’ll lose.) As Doc Searls likes to put it…

Majority of Americans dislike unauthorized use of behavioral data
type: item
creator: Joe Andrieu
date: 2008-04-10T17:55:42Z
subject: Identity
subject: ProjectVRM
subject: Vendor Relationship Management
subject: privacy
subject: VRM
description: From Yahoo News: Majority Uncomfortable with Websites Customizing Content Based Visitors Personal Profiles Level of Comfort Increases When Privacy Safeguards Introduced ROCHESTER, N.Y.–(BUSINESS WIRE)–A majority of U.S. adults are skeptical about the practice of websites using information about a … Continue reading →
encoded: From Yahoo News: Majority Uncomfortable with Websites Customizing Content Based Visitors Personal Profiles Level of Comfort Increases When Privacy Safeguards Introduced ROCHESTER, N.Y.–(BUSINESS WIRE)–A majority of U.S. adults are skeptical about the practice of websites using information about a person’s online activity to customize website content. However, after being introduced to four potential recommendations for improving websites privacy and security polices, U.S. adults become somewhat more comfortable with the websites use of personal information. Good stuff, although one should read closely to understand exactly what users dislike. Customization isn’t the problem… it’s the unauthorized invasion of privacy. The questions asked by Harris were rather leading. It would be interesting to see what people say to “if asked, would you allow a Search engine to provide enhanced results based on your behavior.” My understanding is most people do opt-in to the advanced features of Google desktop, which asks essentially the same question at install time. People don’t like surreptitious activities, but if you ask up front, it’s much easier for folks to say yes.