iiw

You are currently browsing the archive for the iiw category.

Laws of Identity

May 10, 2022 in data, history, Ideas, Identity, iiw | 2 comments

When digital identity ceases to be a pain in the ass, we can thank Kim Cameron and his Seven Laws of Identity, which he wrote in 2004, formally published in early 2005, and gently explained and put to use until he died late last year. Today, seven of us will take turns explaining each of Kim’s laws at KuppingerCole‘s EIC conference in Berlin. We’ll only have a few minutes each, however, so I’d like to visit the subject in a bit more depth here.

To understand why these laws are so important and effective, it will help to know where Kim was coming from in the first place. It wasn’t just his work as the top architect for identity at Microsoft (to which he arrived when his company was acquired). Specifically, Kim was coming from two places. One was the physical world where we live and breathe, and identity is inherently personal. The other was the digital world where what we call identity is how we are known to databases. Kim believed the former should guide the latter, and that nothing like that had happened yet, but that we could and should work for it.

Kim’s The Laws of Identity paper alone is close to seven thousand words, and his IdentityBlog adds many thousands more. But his laws by themselves are short and sweet. Here they are, with additional commentary by me, in italics.

1. User Control and Consent

Technical identity systems must only reveal information identifying a user with the user’s consent.

Note that consent goes in the opposite direction from all the consent “agreements” websites and services want us to click on. This matches the way identity works in the natural world, where each of us not only chooses how we wish to be known, but usually with an understanding about how that information might be used.

2. Minimun Disclosure for a Constrained Use

The solution which discloses the least amount of identifying information and best limits its use is the most stable long term solution.

There is a reason we don’t walk down the street wearing name badges: because the world doesn’t need to know any more about us than we wish to disclose. Even when we pay with a credit card, the other party really doesn’t need (or want) to know the name on the card. It’s just not something they need to know.

3. Justifiable Parties

Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.

If this law applied way back when Kim wrote it, we wouldn’t have the massive privacy losses that have become the norm, with unwanted tracking pretty much everywhere online—and increasingly offline as well. 

4. Directed Identity

A universal identity system must support both “omni-directional” identifiers for use by public entities and “unidirectional” identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.

All brands, meaning all names of public entities, are “omni-directional.” They are also what Kim calls “beacons” that have the opposite of something to hide about who they are. Individuals, however, are private first, and public only to the degrees they wish to be in different circumstances. Each of the first three laws are “unidirectional.”

5. Pluralism of Operators and Technologies

A universal identity system must channel and enable the inter-working of multiple identity technologies run by multiple identity providers.

This law expresses learnings from Microsoft’s failed experiment with Passport and a project called “Hailstorm.” The idea with both was for Microsoft to become the primary or sole online identity provider for everyone. Kim’s work at Microsoft was all about making the company one among many working in the same broad industry.

6. Human Integration

The universal identity metasystem must define the human user to be a component of the distributed system integrated through unambiguous human-machine communication mechanisms offering protection against identity attacks.

As Kim put it in his 2019 (and final) talk at EIC, we need to turn the Web “right side up,” meaning putting the individual at the top rather than the bottom, with each of us in charge of our lives online, in distributed homes of our own. That’s what will integrate all the systems we deal with. (Joe Andrieu first explained this in 2007, here.)

7. Consistent Experience Across Contexts

The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies.

So identity isn’t just about corporate systems getting along with each other. It’s about giving each of us scale across all the entities we deal with. Because it’s our experience that will make identity work right, finally, online. 

I expect to add more as the conference goes on; but I want to get this much out there to start with.

By the way, the photo above is from the first and only meeting of the Identity Gang, at Esther Dyson’s PC Forum in 2005. The next meeting of the Gang was the first Internet Identity Workshop, aka IIW, later that year. We’ve had 34 more since then, all with hundreds of participants, all with great influence on the development of code, standards, and businesses in digital identity and adjacent fields. And all guided by Kim’s Laws.

 

The gentle lawgiver

December 6, 2021 in conferencing, Identity, iiw, Obituary | 2 comments

This is about credit where due, and unwanted by the credited. I speak here of Kim Cameron, a man whose modesty was immense because it had to be, given the size of his importance to us all.

See, to the degree that identity matters, and disparate systems getting along with each other matters—in both cases for the sakes of each and all—Kim’s original wisdom and guidance matters. And that mattering is only beginning to play out.

But Kim isn’t here to shake his head at what I just said, because (as I reported in my prior post) he passed last week.

While I expect Kim’s thoughts and works to prove out over time, the point I want to make here is that it is possible for an open and generous person in a giant company to use its power for good, and not play the heavy doing it. That’s the example Kim set in the two decades he was the top architect of Microsoft’s approach to digital identity and meta systems (that is, systems that make disparate systems work as if just one).

I first saw him practice these powers at the inaugural meeting of a group that called itself the Identity Gang. That name was given to the group by Steve Gillmor, who hosted a Gillmor Gang podcast (here’s the audio) on the topic of digital identity, on December 31, 2004: New Years Eve. To follow that up, seven of the nine people in that podcast, plus about as many more, gathered during a break at Esther Dyson‘s PC Forum conference in Scottsdale, Arizona, on March 20, 2005. Here is an album of photos I shot of the Gang, sitting around an outside table. (The shot above is one of them.) There was a purpose to the meeting: deciding what we should do next, for all of the very different identity-related projects we were working on—and for all the other possible developments that also needed support.

Kim was the most powerful participant, owing both to his position at Microsoft and for having issued, one by one, Seven Laws of Identity, over the preceding months. Like the Ten Commandments, Kim’s laws are rules which, even if followed poorly, civilize the world.

Kim always insisted that his Laws were not carved on stone tablets and that he was no burning bush, but those laws were, and remain, enormously important. And I doubt that would be so without Kim’s 200-proof Canadian modesty.

The next time the Identity Gang met was in October of that year, in Berkeley. By then the gang had grown to about a hundred people. Organized by Kaliya (IdentityWoman) Young, Phil Windley, and myself (but mostly the other two), the next meeting was branded Internet Identity Workshop (IIW), and it has been held every Fall and Spring since then at the Computer History Museum (and, on three pandemic occasions, online), with hundreds, from all over the world, participating every time.

IIW is an open space workshop, meaning that it consists entirely of breakouts on topics chosen and led by the participants. There are no keynotes, no panels, no vendor booths. Sponsor involvement is limited to food, coffee, free wi-fi, projectors, and other graces that carry no other promotional value. (Thanks to Kim, it has long been a tradition for Microsoft to sponsor an evening at a local restaurant and bar.) Most importantly, the people attending from big companies and startups alike are those with the ability to engineer or guide technical developments that work for everyone and not for just those companies.

I’m biased, but I believe IIW is the most essential and productive conference of any kind, in the world. Conversations and developments of many kinds are moved forward at every one of them. Examples of developments that might not be the same today but for IIW include OAuth, OpenID, personal clouds, picos, SSI, VRM, KERI, and distributed ledgers.

I am also sure that progress made around digital identity would not be the same (or as advanced) without Kim Cameron’s strong and gentle guidance. Hats off to his spirit, his laws, and his example.

 

 

From meat space to meet space

April 9, 2020 in adtech, Business, conferencing, Events, iiw, unconferencing | Permalink

We’re 19 days away from our 30th Internet Identity Workshop, by far the best Open Space unconference I know. (Okay, I’m biased, since I’m one of its parents.) For the first time since 2006, it won’t be happening at the Computer History Museum, which (as you might expect) is closed for awhile. C’est la quarantaine. Instead we’re doing it here…

…where nearly all meetings happen these days. (HT to @hughcards for that portrait of the Internet.)

We’re actually excited about that, because we get to pioneer at unconferencing online in meet space, much as we did with unconferencing offline in meat space.

Since you’ll ask, we’ll be doing this with QiqoChat, an online community, meeting and event platform that is integrated with Zoom, which has been in the news lately. As you probably know by now, much of that news has been bad. (Top item this morning: US Senate tells members not to use Zoom.)

I suppose I played a part in that, with Zoom needs to clean up its privacy act (which got huge traffic) and the three posts that followed: More on Zoom and Privacy, Helping Zoom, and Zoom’s new privacy policy.

After the last of those, I spoke with Erik Yuan, Zoom’s CEO, who had reached out and seemed very receptive to my recommendations. Mostly those were around getting rid of tracking on Zoom’s home pages. This is jive that marketing likes and the privacy policy can’t help but cover—which, optically speaking, makes it look like everything Zoom does involves tracking for marketing purposes. The company hasn’t acted on those recommendations yet, but I know it’s been busy. What I read here and here from the Citizen Lab is encouraging. So, we’ll see.

Let’s also remember that Zoom isn’t the only conferencing platform. (The Guardian lists a few among many options. One not mentioned but worth considering: Jitsi, which is open source.)

Back to IIW. As it says here,

  • We will have an Opening Circle each day where we set the agenda
  • People will propose and host sessions, and sessions will be held in breakout spaces
  • After the end of sessions for the day, we’ll do a Closing Circle with Open Gifting ~ just like we always do
  • We will still hold Demo Sessions and the Tech Sandbox Fair
  • We will still publish the Book of Proceedings with notes from all the sessions
  • And, since we can’t have a celebratory cake, we’re planning on a Commemorative T-shirt for everyone, that is included with registration
  • We won’t have Rich, our favorite barista, or a snack table, but we will still have the same high-quality discussions and working sessions that make IIW a unique event

Also,

  • If you’re already registered for IIW, then you’re set. The only thing to do is cancel any travel plans.
  • If you haven’t registered yet, please do so at: https://iiw30.eventbrite.com

So help us make it happen for the first time, and better than ever thereafter.

And let’s hope this quarantine thing is over in time for our next IIW, which will be in both meat and meet space, next October, from the 20th to the 22nd.