Posted 2:11 PM (0) comments

Paul's Desert Island Rule

Paul Madsden has come up with an easy to grasp "Occam's razor" style explanation of what is - and what isn't - "reputation." He posits the Desert Island Rule, which is a:

"...test for whether a given attribute can have a reputation aspect.

Were the entity in question to be located on a desert island with no social contact with others, would the value of the attribute in question be impacted?"

That captures my sense of the notion, also.

Posted 12:51 AM (0) comments

IIW Fall 2008

Only a bit over a month until the fall edition of the Internet Identity Workshop in Mountain View at the Computer History Museum. It's an always interesting event:

Venues for enterprise identity practitioners

Internet Identity Workshop throws up the question of what's next in identity? - Network ...

The geeks' identity incubator

Identity experts gather at Internet Identity Workshop

I'll be there - you should be too.

Posted 9:40 PM (0) comments

Makes me look nice...

The Register's Ted Dziuba makes me look like a group-hugging flower-child with his latest story ("OpenSocial, OpenID, and Google Gears: Three technologies for history's dustbin"):

"What about OpenID, the best damned federated authentication scheme the world has ever seen, but nobody in the world can figure out how to use?"

or

"This situation gets really dangerous when you start to involve people from San Francisco. Every person who lives in San Francisco has the intention of starting a nonprofit organization of some sort. Therefore, if you collect a bunch of Web 2.0 engineers in San Francisco, the inevitable outcome is the OpenSocial Foundation: a nonprofit organization that only exists to support an API for programming social network applications."

Peace and love, children.

Labels: Google, openid, social networks

Posted 10:42 AM (1) comments

Conflating "identities," er, Personas

"jhullman," of internet marketing company Pure Visibility, has a post today on the changes that technological advances have had on people's desire (and ability) to segregate their work life from their, um, "non-work" life: "What is it that has changed in the last 20 years, causing employees who may have avoided all thought of work after hours in the past to feel so compelled to answer, say, the stray business-related emails that trickle in on the weekend?"

I don't think it's the technology that makes this happen, nor is it some 3rd party aggregation of our identity data. If you don't want to be tempted to reply to work email on the weekend, have a seperate email account for your personal correspondence. Problem solved.

Well, not really. There's still the problem of getting people to actually NOT LOOK AT the office email during personal time.

The post concludes:

"'La perruque' is the french term for personal business done on company time, which no doubt spiked upon the embracing of the internet in many an organization. Michel de Certeau writes in his book 'The Practice of Everyday Life' that la perruque is a tactic used by the masses to subtly resist the powers that be. The real question is, What is the french word for the opposite, the subtle influence on employee identities exerted by the business, even the off hours?"

The French don't have a word for that, because the French would think you were crazy to do such a thing. What's the English for "joie de vivre?" - maybe we can learn from Paris...

Posted 1:52 PM (0) comments

Identity-centric

Pam Dingle has a bit of a rant today about the term "user-centric." Well, not about the term itself but about people's desire (e.g., the entire Burton Group) to get away from it.

"Sure, there are a few blind worshippers of the cult of user-centric out there, but I firmly believe that common sense has to win out in deployment scenarios, and that various technologies should and will be used where applicable to solve problems. "

"If, on the other hand, all this is about is finding a positive, all-encompassing touchy-feely name to give to the systems-formerly-known-as-user-centric so that isn’t all about conflict, fine — pick a new name already. I only ask that if you’re going to diss the current buzzword, can you please at least supply an alternative suggestion. Otherwise we end up in limbo where nobody wants to use the old term, but nobody has a new term either, making us all look like indecisive idiots."

I think it's about more than just a term, more than just a feel-good quality, Pam. The "User-centric" term was coined, initially, to try to differentiate internet-based individual identity protocols from those used within the enterprise. But it's really all identity, and there doesn't need to be a distinction. That's why I wrote, last month, "Why there's no 'user-centric' or 'enterprise-centric' identity," where I said:

"Enterprise-centric identity management, we postulated, is really all about tying together all the activities and attributes of a single entity into a readily accessible (and reportable and auditable) form; while user-centric identity is about keeping various parts of your online life totally separated so that they aren't accessible and no report can be drawn.
So how do we have a framework that allows for both tying together all of a user’s activities (enterprise-centric) while at the same time allowing distinct separation of activities as decided by the user?
We start by defining identity as a group of “personas” (see 'Defining identity, persona, role'). Any persona can be made up of a group of personas or roles. Each of those personas can be linked, or separated, as the entity identified by them wishes. One of those personas is (or, rather, could be) an 'enterprise persona.' That one brings together '…all the activities and attributes of a single entity' performed for or related to that enterprise '...into a readily accessible (and reportable and auditable) form.'
So there is no 'user-centric' or 'enterprise-centric' identity. There is just an entity with AN identity made up of various personas some of which may be controlled or limited in some way by an outside organization – not only by the enterprise but also by governments, social organizations, etc. The ability to keep these personas separate, where legally able to do so, must be a given. Each persona will have different identity needs and requirements, of course, but that’s what will drive the 'identity economy' as vendors seek to satisfy those needs and requirements in accordance with the laws. The government’s laws, the enterprise’s 'laws', the fraternal and social organization’s 'laws' and the Laws of Identity as laid down by [Kim] Cameron. "

Labels: Burton Group, digital identity, enterprise, identity, Laws of Identity, persona, roles, user centric

Posted 8:39 AM (0) comments

Google-oops

A big tip o'the hat to Kim Cameron who today points out a security white paper from US-CERT describing an incredibly bad - and incredibly naive - security vulnerability in Google's SSO implementation.

The kicker isn't that there is a vulnerability, but, as Kim says, "the surprising fact is that the errors made are incredibly basic."

The Google wunderkind evidently ignored major parts of the SAML spec (while claiming to be SAML compliant) leaving the SSO completely open to the most basic insider attack. More incredibly, they extended this vulnerability to third parties so that their insiders could get in on the attack!

Gogle just turned ten, but it's thinking is more like that of a 17-year-old, one who knows what they want to do and can't be bothered to cross all the t's and dot all the i's in their head-long rush for personal fulfillment. They also think they'll live forever, and that they discovered sex (drugs, rock & roll, whatever). It's a very dangerous age but - if they survive it - they may go on to do great things. My hope is that the rest of us survive it, also.

Labels: Google, SSO

Posted 8:18 AM (0) comments

more IDtbd

When I posted about the IDtbd group meeting last week (see YAUG - Yet Another Umbrella Group) I worried that perhaps I was the only one not seeing the benefit of this proposed organization. Now OpenID's David Recordon has posted his notes on the meeting which - looking at those parts of the meeting I attended - appear to very accurately reflect what was said. And it would appear that those present who are not members of the Liberty Alliance remained quite skeptical of the new group. The objections, as David notes, are fairly generally accepted:

• Autonomous projects
• Less funding
• Board has too much authority
• Plan for introducing a new organization should be more incremental

He also notes that Sun's (and Liberty Alliance secretary) Bill Smith raised a strong objection to what I'd written and was "...Asking for all future meetings to be private with no public notes so that people can speak more frankly. " Sadly, that's what I've come to expect from the Liberty Alliance - let's not discuss our differences, let's simply stifle them. That organization was born in darkness from a small group of invited participants which brooked no intrusions or comments from the outside and which reserved the chairs on its oard of Directors to only those first invited organizations for a very long time.

What's really fascinating is that IDtbd claims to want "To promote harmonization" but evidently needs to stifle dissent in order to do so!

Labels: DIDW, liberty alliance, umbrella

Posted 8:16 AM (0) comments

Congratulations!

...to all my friends at NetPro and Quest who now will operate under the same banner. Quest, over the past 6 or 7 years, has slowly acquired a number of key players in the 3rd party Microsoft managed identity space from FastLane (back in 2000) through Vintela a couple of years ago. Each time, key players from the acquisition have come along to oversee integration and each time it seems to have gone off without a hitch.

Time will tell how the Experts Conference might be affected, but Quest has been involved there for a few years and I doubt they'll do anything to tamper with success (unlike, say, CSO and Digital ID World).

I wonder if NetPro CEO Kevin Hickey will trade in his Yankee pinstripes for Dodger blue?

Labels: acquisition, Active Directory, trade show