Identity Woman

Independent Advocate for the Rights and Dignity of our Digital Selves

Innovation

Misinformation Stops Here: W3C VC 2.0 Supports JSON

· ·

Misinformation sometimes gets a foothold and spreads across the digital identity oriented forums. 

A most recent piece that is percolating is: the Verifiable Credential (VC) Data Model 2.0, which is under development within a formal W3C working group, does not or will not support JSON. 

What is true: 

W3C VC 2.0 is 100% capable of supporting JSON. 

Always has been and always will be. 

And that is the simple fact

However, navigating and making sense of the technical politics and different motivations among different groups over the long span of standards development and evolution are never simple. I have theories that seem to change daily depending on who I talk to about what is going on and why but that isn’t really relevant or important at this point. As the standard we have all been putting our heart and sweat into gets serious market attention and adoption, as a community, we need to stand together and bring simple basic truths to light. 

The Historical Context of the JSON vs. JSON-LD

From the very beginning of the VC work, there have been two camps: 

  • the JSON people 
  • the JSON-LD people
  • AND the “can’t we all get along people” ← I put myself in this group. 

I have empathy for both camps. I understand the reasoning both have and I think both are needed to make a viable ecosystem work in the long run (I explain more about this in a separate post here). Both camps worked incredibly hard to find a way to make sure both could live with the V1 of the specification. 

Here is my explanation of the compromise for V1: 

There is one “extra” field that JSON-LD requires/needs which is @context and if you didn’t want to use it and simply wanted to ignore it and just do JSON you could. The VC would be entirely compliant and thus both data expression formats could live in the same specification. JSON-LD credentials that did have an @context that were being read by tooling that just did JSON could still read the credentials – it did nothing to interfere. This seems like a pretty good “let’s figure out how to live with each other” solution. 

Another simpler way to understand this is that JSON-LD is JSON but the inverse is not true. JSON is not JSON-LD. 

That is, a few little bits need to be added in to make JSON-LD be JSON-LD but those little extra bits don’t make it “NOT” JSON. However these little extra bits if they are not there…mean the data model is no longer JSON-LD. 

I was there for the discussions at the Verifiable Credential Working Group face-to-face meeting that happened in Miami in early 2023, where a similar compromise was reached for V2 of the specification that was inclusive of JSON and JSON-LD. 

Relevant Community Work/Discussions on V2. 

The community had very long (296 comments) very intense discussions threads on the issue #947. 

It has been suggested that the use of @context should be made optional. This would be a normative change to the current specification, as the use of @context is required in both JSON and JSON-LD. This issue is to discuss if this is a good idea and the mechanism(s) that could be used to accomplish the task. 

Both sides are very passionate and have their own points of view and good reasoning. Lots of in person discussions were on this with the chairs sitting at a table talking to lots of community members for a long time. 

Incredible work was done by the community to figure out how both could be supported. 

Orie Steele did an amazing job of fairly putting forward the core issues that came up on the thread with both sides. He also summarized three different solutions. One path forward was chosen to go with media types. Here is the resolution that passed and celebrated that is the compromise for V2. 

This was it:

Resolution #1: The base media type for the VCDM is credential+ld+json. @context is required (MUST) in the base media type; other media types MAY choose to include @context. Serializations in other media types (defined by the VCWG) MUST be able to be transformed into the base media type. Another media type MUST identify if this transformation is one-directional or bi-directional. Bi-directional transformation MUST preserve @context. Transformation rules MUST be defined, but not necessarily by this WG..

It was a really intense day to get to this resolution. If you want to read the whole discussion from that day and all the polling you can. I am an invited expert in the working group and I was there through the whole thing. I was really proud of how everyone really struggled to find a path forward that everyone could live with. It was a huge relief. Everyone felt it, the JSON people and JSON-LD people. Mike Jones, one of the strongest JSON proponents, said this at the end of the day. 

Michael Jones: I would not FO [File an Objection], and is grateful for people’s work today.

Addendum: The for the above resolution to work the IETF Media Type group needs to accept such a media type construction. I’m at IETF right now we shall see where it goes. 

More Community Context Since the Miami Meeting 

In the last few weeks some strange things have happened with the specification. 

Recently a section of the specification on Syntaxes that was worked on in V1 of the specification that was explicitly created to make sure JSON was included was removed – even though concerns were raised about doing this by JSON-LD people who didn’t want it taken out

The most problematic removal was this:

“Just because there is a @context doesn’t mean you have to do JSON-LD processing”

In the last week several Issues and Pull Requests to support further clarification of how the V2 specification does support JSON. 

  1. This one fully implements the resolution from the Miami F2F meeting: (giving all JSON-only, mdoc-only, CBOR-only formats a path to compatibility with Verifiable Credentials) by adding a section on Ecosystem Compatibility.
  1. This issue articulates the issue documents how VCs are processed as JSON today and this is the pull request that demonstrates JSON Processing has engagement to really help clarify the language in the specification itself. 

It is also worth understanding some key compromises have been made in particular by the JSON-LD people over the course of developing the specification in the last year.

  1. @vocab was added to support developers who know JSON & JWT be able to do semantics (Here is the issue) below is a quote from it
    • By adding @vocab to the core data model context, we can give these developers the same experience they have with JWT private claims, which you should read about here: rfc7519#section-4.3
  1. ALL JSON is compatible w/ the VCDM now (as long as you have that ONE @context name in your VC) – you can see this explained in the getting started section. 
  1. Here is another example of us limiting JSON-LD usage (to enhance the experience for JSON-only developers): 
  1. Another another example of “turning off error reporting in JSON-LD” to address the needs of the  JSON-only crowd 

There is a whole sub specification within the working group that was just updated this week. 

Verifiable Credentials JSON Schema Specification 2023, JSON Schemas for Verifiable Credentials, W3C First Public Working Draft 12 July 2023

Here is an in depth comment explaining how the spec is capable of supporting JSON. 

A lot of hard work and compromises were made to have both JSON and JSON-LD both be within V2.0. 

We need to stop the misinformation. It is destructive and corrosive to the community. 

 

 

My Talk at New America on Self-Sovereign Identity & the Domains of Identity

· ·

The Future of Property Rights a program at New America just published a new report The Nail Finds a Hammer: Self-Sovereign Identity, Design Principles and Property Rights in the Developing World. I commented extensively on the paper before publication and they included the Domains of Identity within the report. It turns out that many of the Domains of Identity include registries. This whole perspective that registries as the root of many of our systems is very eye opening. Just like when one finds identity one sees it everywhere, it turns our registries are everywhere too.
Mike invited some key contributors to the paper to talk at New America. I presented about both Self-Sovereign Identity AND the domains of Identity … enjoy!!!
https://www.youtube.com/watch?v=U8bZ4GYFwKY

Meta-Governance

· · Leave a Comment

This spring I attended the Executive Education program Leadership and Public Policy in the 21st century at the Harvard Kennedy school of government with fellow Young Global Leaders (part of the World Economic Forum).  A line of future inquiry that came to me by the end of that two weeks –
How do we design, create, get functioning and evolve governance systems?
The governance of governance systems = Meta-Goverancne. 
At the Kennedy program all they could talk about was “individual leadership” (with good advice from good teams of course) at the top of  Organizations.  They all waved their hands and said “Good luck young leaders, We know its more complicated now…and the problems are bigger then just organizational size but we don’t really know how what to tell you about how to interorgainzational collaborative problem solving and innovations…so “good luck”.
It was surreal because this inter-organizational, complex space is where I spend my work life helping design and facilitate unconferneces – it is in that complex inter organizational place.
I have this clear vision about how to bring my two main career bodies of knowledge together (digital identity + digital systems & design and facilitation of unconferneces using a range of participatory methods) along with a range of other fields/disciplines that I have tracked in the last 10 years.

Web Wide Sentence Level Annotation -> Hypothes.is

· · Leave a Comment

I first met Dan Whaley last spring via an introduction from Jim Fournier co-founder of Planetwork.  I was inspired by the vision he was working on building Hypothes.is –  a way to have sentence level annotation of news and other articles on a web wide scale. Really a foundation for peer review on the web. The motivation for his work is to support greater discernment of the truth around climate change and other key issues facing our society and our planet.  (Another area I could see this being really useful right now is around accountability in the financial system and ways to make that real.)
He asked me to be a part of the project as an advisor particularly around identity issues and technology options for identity.  He is taking my advice and coming to IIW this coming week.  Its an honor to be amongst other distinguished advisors like Brewster Kahle,  John Perry Barlow,  Mark Surman and others..

He has been working on a development plan and has a solid on one in place.  He has launched a Kickstarter Campaign and  stars in the video that articulates the vision of the project.  If you are inspired by the vision I encourage you to contribute.

Proactive Development of Shared Language by NSTIC Stakeholders

· · 2 Comments

This is the “punchline section” (in my response it is after what is below…the history of collaboration in the identity community):

Proactive Development of Shared Language by NSTIC Stakeholders

In 2004-5 the Identity Gang (user-centric identity community) was 1/10 the size of the current NSTIC stakeholder community.  It took us a year of active grassroots effort to develop enough common language and shared understanding to collaborate. NSTIC doesn’t have 5-10 years to coalesce a community that can collaborate to build the Identity Ecosystem Framework. To succeed, the National Program Office must use processes to bring value and insight while also developing  shared language and understanding amongst stakeholders participating.
[Read more…] about Proactive Development of Shared Language by NSTIC Stakeholders

Privacy Identity and Innovation – pii & Women

· · Leave a Comment

The Privacy Identity and Innovation is coming up August 17-19th in Seattle, Washington.
This conference is the brain child of Natalie Fonseca who has run the Tech Policy Summit for several years.
I am speaking at the event on a panel about personal data stores (a new project I will write more about here soon).  I am really proud to be amongst many other women industry leaders speaking. I know Natalie took proactive approach to recruiting women to speak and voila – their are women speakers at this technology conference.
Denise Tayloe, CEO of Privo
Marie Alexander, CEO of Quova
Linda Criddle, CEO of Reputation Share
Fran Maier, President of TRUSTe
Anne Toth, Chief Privacy Officer for Yahoo
Michelle Dennedy, VP at Oracle
Judith Spencer of GSA
Christine Lemke, CTO of Sense Networks
Betsy Masiello of Google
Heather West of Center for Democracy and Technology
Eve Maler of PayPal
Susan Lyon of Perkins Coie
Deborah Estrin of UCLA
It should be a great event – the guys on the program are equally cool.

When to share your real name? Blizzard and their Real ID plans.

· · 1 Comment

I was recently CCed in a tweet referencing this article “Why Real ID is a Really Bad Idea“about World of Warcraft implementing their version of a “Real ID” in a way that violated the trust of its users.
The woman writing the article is very clear on the identity “creep” that happened and got to the point of requiring users to use the Real ID account within the system to post on forums and EVEYWHERE they interacted on company websites.
She articulates clearly why this creates an unhealthy climate and a chilled atmosphere for many users.
[Read more…] about When to share your real name? Blizzard and their Real ID plans.

On Social Web TV

· · 1 Comment


I was down in Mountain View yesterday to appear on Social Web TV. I was a special guest as Chris and David were both at FOWA in London. We got to talk about the community process around the Internet Identity Workshop and Data Sharing events that has helped moved the standards for the open social web forward.
I hope you enjoy the episode – I clearly need to practice being on “TV” a bit more but hey – don’t we all.

What the Heck is Identity Commons?

· · 4 Comments

The purpose of Identity Commons is:
The purpose of Identity Commons is to support, facilitate, and promote the creation of an open identity layer for the Internet — one that maximizes control, convenience, and privacy for the individual while encouraging the development of healthy, interoperable communities.

This one sentence jams a lot into it – we tried to do that so the purpose didn’t go on and on – but was clear, broad and inclusive of the range of issues that need to be addressed and balanced. Jamming so much into that one sentence also creates a challenge – it has to be ‘parsed’ quite a bit to get what it all means. I worked with Chris Allen recently to separate out the values within the purpose and our community. This is our initial draft that is still evolving (wordsimthing suggestions are welcome).

We believe in the dignity of human individual in the context of the digital world.
In order to make this true we strive for a balance of factors and valuesas digital systems and tools evolve:

  • Individual control, convenience & privacy
  • Sharing of information when participating in community
  • Support for commercial and non-commercial exchange
  • Interoperability and openness between systems

We work to bring these values into practice by fostering a collaborative a community of individuals, organizations and companies share these values and are working together towards practical technical implementations.
We share a pragmatic idealism.
We work to practice what we preach and have openness and transparency in what we do.

We do know there are a lot of technical social and legal issues that arise and Identity Commons is a space that make it possible to in a non-directive non-hierachical way address them in a collaborative way.
We also have some shared principles mostly concerning how we organize ourselves and work together. Each has a sentence to articulate it further.
1. Self-organization
2. Transparency
3. Inclusion
4. Empowerment
5. Collaboration
6. Openness
7. Dogfooding
What the heck is an “open identity layer” – well we don’t exactly know but we do have a community that has come together some shared understanding and continue to ‘struggle’ with what it means and how it should work. Identity Commons provides a ‘common’ space to work on this shared goal by facilitating dialogue and collaboration.
Kim Cameron introduced the terminology “identity meta-system” and articulated what that might mean. The Laws of Identity were put forward by him along with some additional ideas by other community members.
There is no “decider” or group of deciders or “oversight committee” as part of Identity Commons ‘directing’ the development of the “open identity layer”.
We are a community collaborating together and working to exchange information about our independent but related efforts working towards the vision. The way we do this is via the working group agreement.

  1. Asking each working group to articulate its purpose, principles and practices by filling out a charter – this helps us be clear about how different groups work and what they do/are planning on doing
  2. Stewards review proposed working group charters – ask questions, consider were there are synergies, and see if they are aligned with the purpose and principles
  3. A vote of the stewards council is held
  4. Working Groups agree to report quarterly on their activities to remain active as groups of the organization – this also is our core ‘inter group communication mechanism – so that you don’t have to be on 20+ mailing lists to know what is going on in the community.

More about Stewards:
Each working group has one steward and an alternate for the stewards council.
The stewards are responsible for the things IC holds in common – the brand and its integrity and common assets (like the wiki and bank account). It does not ‘direct things’.
Stewards have (an optional) monthly phone calls and discuss and make decisions on a mailing list (that anyone can join).
More about Working Groups:
There are working groups within Identity Commons that support the community collaborating – the stewards council does not ‘run’ these groups but they serve the community and our efforts together- The Internet Identity Workshop, IC Collaborative Tools, Idnetity Futures, Id Media Review, Identity Gang, Marketing and Evangelism.
Working Groups come in several forms:
They can be an group of people with a passion to address something they feel needs to be addressed to get to the big vision. They want some wiki space and a mailing list to talk about the issues. Examples include Enterprise Positioning, Inclusive Initiatives, Identity Rights Agreements.
They can be an existing project that are part of a larger organization, Higgins is an example of this – they are a project of the Eclipse Foundation.
They can be something that grew out of conversations in the Identity Commons community and found a home within another organization like Project VRM (charter) has as part of the Berkman Center and will likely become its own ‘organization’ independent of Berkman by the end of the year.
They can be completely independent nonprofit organizations with their own boards, governance, bank account etc. examples include XDI.org and OpenID.
Some just get technical stuff done as part of IC like OSIS (doing its 3rd Interop at RSA in a month), and Identity Schemas.
Benefits to being explicitly a part of the IC Community.
clarity about each groups purpose, principles, and practices – so that collaboration is easier.
sharing of information via the collaborative tools and lists, along with the required quarterly reporting,
We “don’t know” what an identity layer looks like but we do know it needs to have certain properties to make it work for people the extensible nature of IC gives people the freedom to start a new group that addresses an aspect of the vision. This is the page on the IC wiki that explains our organizational structure.
We are a community.
We are a community more then “an organization” and joining does not mean subsuming a group identity under IC but rather stating a commitment to a shared vision, common values and commitment to collaboration.
A touch of formalism can help create great clarity of group pratices (governenace), leadership, intention, and focus. Not needed for small groups of 12 people doing one thing- helpful when you scale to the 1000’s of people working on the big vision. IC through its groups structure has 1000’s of people participating helping to innovate the technology and think about the social and legal implications.
We are not about “a solution” or “a blue print” there will be multiple operators and multiple standards – yes like the web there may one day be ‘standard’ that emerges just like TCP/IP did and HTML/HTTPS – however it is way to early to promote or be behind “one” thing, it is not to early to start collaborating and building shared meaning and understanding and interoperability between emerging efforts.
Identity problems in the digital realm are as much about technical issues as they are about the social implications and legal issues. Identity Commons explicitly makes space for the social and legal issues to be deal with in relationship to the technologies as it evolves.
In closing there is a background (shorter) and a history (longer) written about the community as it evolved.

AT&T has programming language for surveillance

· · Leave a Comment

on the WIRED Blgo Network

From the company that brought you the C programming language comes Hancock, a C variant developed by AT&T researchers to mine gigabytes of the company’s telephone and internet records for surveillance purposes.
An AT&T research paper published in 2001 and unearthed today by Andrew Appel at Freedom to Tinker shows how the phone company uses Hancock-coded software to crunch through tens of millions of long distance phone records a night to draw up what AT&T calls “communities of interest” — i.e., calling circles that show who is talking to whom.
The system was built in the late 1990s to develop marketing leads, and as a security tool to see if new customers called the same numbers as previously cut-off fraudsters — something the paper refers to as “guilt by association.”

Soon we will know what you are thinking

· · Leave a Comment

This came through Slashdot and was on the BBC:

Since 9/11, some of the best scientific minds in the defence industry have switched their concentration from tracking nuclear missiles to tracking individuals such as suicide bombers.
This quote is in the side bar make it sound all OK. Opinion polls, both in the US and Britain, say that about 75% of us want more, not less, surveillance

 
 

Ian Kitajima flew to Washington from his laboratories in Hawaii to show me sense-through-the-wall technology.

“Each individual has a characteristic profile,” explained Ian, holding a green rectangular box that looked like a TV remote control.
Using radio waves, you point it a wall and it tells you if anyone is on the other side. His company, Oceanit, is due to test it with the Hawaiian National Guard in Iraq next year, and it turns out that the human body gives off such sensitive radio signals, that it can even pick up breathing and heart rates.
“First, you can tell whether someone is dead or alive on the battlefield,” said Ian.
“But it will also show whether someone inside a house is looking to harm you, because if they are, their heart rate will be raised. And 10 years from now, the technology will be much smarter. We’ll scan a person with one of these things and tell what they’re actually thinking.”

AOL launches cool OpenID enabled App: Ficlet

· · Leave a Comment

Yesturday walking through the exhibit hall at SXSW the AOL Principle Product Managerd Micheal Cummins came up to me and said he had to show me this new OpenID enabled app – Ficlets.
It is a really cool idea – you get to start a story by writing a ficlet and other people get to continue it. The first thing that came to my mind was the fact that you could end up with collaboratively created Choose your own Adventure style stories.
The other thing that this makes clear is that someone inside AOL has read the Innovators Dilemma/solution and is supporting a creative culture within the company. With this I look forward to seeing what other cool apps/features emerged and how they can play in cultivating an thriving OpenID ecology.

Polar Rose soon to search photos for faces on the web

· · Leave a Comment

This story comes from Slashdot. A startup Polar Rose is about to launch a face search tool.

Polar Rose relies on a combination of our unique face recognition algorithms and the collective intelligence of our users….we don’t and can’t rely exclusively on face recognition, but also harness the collective intelligence of our users who help train our software and tag names on people we haven’t seen before.
We will open up for a royalty-free use of our API’s, which will allow for partners to integrate the Polar Rose functionality into existing sites or create stand-alone applications of Polar Rose, for example:
* A news site that wants to let users help tag photos, and link stories together based on who appears in photos.
* A photo-sharing site that wants to let users automatically tag new uploads, and search and sort archives based on the people in a photo.
* A social networking or dating site that wants to wants to help users find more pictures of a person, elsewhere on the net or just in the photos of the person’s friends.
The only significant requirements we put for the use of the APIs, is that the Polar Rose signature rose is used, and data that users generate is passed back to us on a non-exclusive basis. The reason being that every piece of data helps train our engine.

Some have privacy concerns. I certainly do – when Riya was pitching similar face recongintion for a flickr like tool I was creeped out. They are now doing a visual search engine so you can put in a purse or boot that you like and it searches for purses and boots like that.

Privacy concerns from New Scientist:
Polar Rose and future developments that make facial recognition available to the masses risk encroaching on people’s privacy, warns Yaman Akdeniz, director of the UK non-profit group Cyber-Rights & Cyber-Liberties.
“Although this sounds like a great idea, I would not like to be searchable in this way, or so easily tracked without my consent,” says Akdeniz. The database compiled by Polar Rose is similar to the kind of biometric database some governments wish to use, he points out.
“I wonder whether they have a right to build such a database,” says Akdeniz, he suggests people think twice before embracing such potentially intrusive tools, and consider which photos of themselves they allow online.
Others agree. Simon Davies, director of the campaign group Privacy International and a specialist in technology and privacy at the London School of Economics, UK, says face-searching technology is valuable but must be used responsibly.
He fears Polar Rose could help identity thieves or stalkers, or even be used by the police to monitor protesters. “They could use the service to find where people have been, what their activities are, or who they associate with,” he says.
Search engines should allow users to prevent their photos being searched, says Davies. “There should be a way to put code in a webpage that signals you want to opt out,” he told New Scientist.

Sneaker Tracking

· · Leave a Comment

From Bruce Schneier:

However, it turns out that the transmitter in your sneaker can be read up to 60 feet away. And because it broadcasts a unique ID, you can be tracked by it. In the demonstration, the researchers built a surveillance device (at a cost of about $250) and interfaced their surveillance system with Google Maps. Details are in the paper. Very scary.

Cool new wiki feature

· · Leave a Comment

I went through TechCrunch today as I do on a weekly basis to check out what is new in web2 land. Lots of kids building interesting things but I kind of think mmmm…to a lot of them. Also lots of acquisition rumors. By the end of it I wondered why me? Why this industry almost completely devoid of meaning in a particular way.
The one cool ting that I did find was a new feature called “UnPlug” for SocialText Wiki’s so you can get a section of a wiki you want to edit on your computer and work on it ofline (say on a plane ride) and then when you plug back in it is uploaded. VERY COOL.

Office 2.0 – There is a real market!

· · Leave a Comment

Ramana Rao was on the closing panel at Office 2.0 and put forward this question:

I asked a few vendors if they would support OpenID for login if say 25 other Office 2.0 vendors would, and I generally got a pause, and then what appeared to be qualified nodding. Well, frankly if this simple matter can’t be resolved among the open world slice-o-function vendors, or the suite newcomers, then it’s hard to imagine the harder problems of fragility being addressed either.

Cool Human Internet tricks

· · Leave a Comment

They are relevant to identity because it is interesting how people use the net to form their identity and do interesting things to make a buck doing things that would be impossible without it.
There are a few interesting “Internet Tricks” that I have come across and I thought I would share. The earlier one is One Million Pixels – where a guy sold one web page’s pixels for a dollar each in minium blocks of 10×10. He made his money.
This one a guy started off with One Red Paper Clip and is trading it up for a house he started less then a year ago and is now trading for a years free rent in Pheonix.

Broadband Scandal – heading towards 3rd world connectivity

· · Leave a Comment

$200 Billion Broadband Scandal was posted to a list I am on today.

New investigative ebook offers micro-history of Verizon, SBC, Qwest, and BellSouth’s (the Bell companies) fiber optic broadband promises and the consequence harms to America’s economic growth because they never delivered and kept most of the money, about $200 billion.
New York: This is one of the largest scandals in American history. America is 16th in the world in broadband and the US DSL current offerings are 100 times slower than other countries such has Japan and Korea. How did we go from Number 1 in the web to 16th in broadband and falling?
* Are customers owed $2000 for a fiber optic service they paid for but never received? Did towns and cities, libraries and schools, government agencies, and every residential and business customer subsidize new networks that never showed up?
* Did America lose $5 trillion in economic growth, $500 billion annually, because of these missing networks?

Kaliya's the shit. Be there or be square.Enlighten yourself through her